Edge types
Filtered:
from Data
to AdministrativeBoundary
- 6 of 80.
Clear
Container holds child resources/objects: administrative boundaries, storage containers, data stores (SQL servers and their databases/firewall rules), secret vaults (Key Vault and its secrets/keys), management services and their artifacts.
structural
Recon: resource references another (connection targets, IaC). Aids collection, not traversal. Network sources (e.g., Route 53 DNS zones) reference alias targets like ELB/CloudFront/S3; dangling aliases are a legitimate structural relationship.
data
A trust/resource policy names a principal in another account (feeds CanAssume/CanEnterAccount). Produced by explicit normalization (policy artifact parsing) and by derived rules (cross-account data-resource sharing patterns like S3 bucket policy with foreign principal). Subscription targets cover Azure's account-boundary analog - a cross-subscription trust (e.g. an approved cross-subscription Private Endpoint connection, or cross-subscription VNet peering).
cross_boundary
walkable
Reachable/usable account/subscription/project-wide.
network
walkable
Reachable/usable by any principal in the tenant/org (broad blast radius).
network
walkable
Placement metadata (region/subnet). Useful for filtering, not traversal.
structural