Edge types

Container holds child resources/objects: administrative boundaries, storage containers, data stores (SQL servers and their databases/firewall rules), secret vaults (Key Vault and its secrets/keys), management services and their artifacts.

Recon: resource references another (connection targets, IaC). Aids collection, not traversal. Network sources (e.g., Route 53 DNS zones) reference alias targets like ELB/CloudFront/S3; dangling aliases are a legitimate structural relationship.

A trust/resource policy names a principal in another account (feeds CanAssume/CanEnterAccount). Produced by explicit normalization (policy artifact parsing) and by derived rules (cross-account data-resource sharing patterns like S3 bucket policy with foreign principal). Subscription targets cover Azure's account-boundary analog - a cross-subscription trust (e.g. an approved cross-subscription Private Endpoint connection, or cross-subscription VNet peering).

A workload (Compute or Messaging) runs under the target identity. Zero-cost link (a fact, not an action) enabling CanExecuteAs derivations. Includes orchestration workflows, logic apps, and event consumers running as a specified identity.

Target is reachable/abusable from the public internet - common attack entry point (incl. a queue/topic/API with a public/wildcard resource policy).

Resource contains/leaks a credential usable for the target identity (env var, code, connstring, metadata, API key). Target can be a Credential, Identity, or Secret/APIKey node.