Edge types

Source can reach target over the network (post SG/firewall/route evaluation). Messaging source/target covers publicly- or privately-reachable messaging endpoints (a queue/topic/event-bus with a public resource policy is an internet-reachable target; a private messaging endpoint is a private-link source/target) - consistent with ExposedToInternet and PrivateReachability, which already admit the Messaging class.

Reachability to a specific service port (gates exploitation of a listening service).

Reachable/usable account/subscription/project-wide.

Target is reachable/abusable from the public internet - common attack entry point (incl. a queue/topic/API with a public/wildcard resource policy).

Reachable/usable by any principal in the tenant/org (broad blast radius).

Network peering - expands reachability across VPCs/VNets/accounts.

Reachable only via private networking (PrivateLink/PE/PSC) - needs a foothold in-network. Includes private APIs and messaging endpoints accessible only via interface endpoints, and object storage reached via a private/gateway endpoint (Azure Blob/Files PE, GCS via PSC). Network sources cover the endpoint/distribution itself acting as the reachability actor (e.g. a CloudFront distribution's OAC/OAI reaching a private S3 origin, or a Private Endpoint node).

Routing fact feeding CanNetworkReach derivation.