Edge types
Filtered:
from Compute
to Secret
- 8 of 80.
Clear
Source can use a key to decrypt data/secrets (gates CanReadData on encrypted stores).
credential
walkable
high value
Source can obtain a usable credential (instance metadata token, env var, key file).
credential
walkable
Source can read secret material (often yields creds for another identity/service).
credential
walkable
high value
Source can obtain an access/OIDC token for an identity (metadata endpoint, token mint).
credential
walkable
Resource stores a usable credential. Includes hardcoded credentials in workflow definitions, SAS keys in message connectors, and API keys in event subscriptions.
data
walkable
Recon: resource references another (connection targets, IaC). Aids collection, not traversal. Network sources (e.g., Route 53 DNS zones) reference alias targets like ELB/CloudFront/S3; dangling aliases are a legitimate structural relationship.
data
Resource stores secret material (drives ExposesCredential).
data
walkable
Resource contains/leaks a credential usable for the target identity (env var, code, connstring, metadata, API key). Target can be a Credential, Identity, or Secret/APIKey node.
credential
walkable