Edge types
Filtered:
from Compute
to Storage
- 7 of 80.
Clear
Destructive impact; not escalation.
data
Can move data out of boundary (share snapshot cross-account, presign URL, replicate).
data
walkable
Source can reach target over the network (post SG/firewall/route evaluation). Messaging source/target covers publicly- or privately-reachable messaging endpoints (a queue/topic/event-bus with a public resource policy is an internet-reachable target; a private messaging endpoint is a private-link source/target) - consistent with ExposedToInternet and PrivateReachability, which already admit the Messaging class.
network
walkable
Effective data-plane read (control-plane perm + network reach + decrypt if encrypted). Includes reading messages from a queue/topic/stream.
data
walkable
high value
Effective data-plane write (can poison code/artifacts/config → onward execution). Includes publishing/sending to a queue/topic/event bus.
data
walkable
Recon: resource references another (connection targets, IaC). Aids collection, not traversal. Network sources (e.g., Route 53 DNS zones) reference alias targets like ELB/CloudFront/S3; dangling aliases are a legitimate structural relationship.
data
Reachable only via private networking (PrivateLink/PE/PSC) - needs a foothold in-network. Includes private APIs and messaging endpoints accessible only via interface endpoints, and object storage reached via a private/gateway endpoint (Azure Blob/Files PE, GCS via PSC). Network sources cover the endpoint/distribution itself acting as the reachability actor (e.g. a CloudFront distribution's OAC/OAI reaching a private S3 origin, or a Private Endpoint node).
network
walkable