Edge types

Physical/logical attachment. Semantic edges (ExecutesAs, HasPolicy) carry the security meaning.

Source can reach target over the network (post SG/firewall/route evaluation). Messaging source/target covers publicly- or privately-reachable messaging endpoints (a queue/topic/event-bus with a public resource policy is an internet-reachable target; a private messaging endpoint is a private-link source/target) - consistent with ExposedToInternet and PrivateReachability, which already admit the Messaging class.

Reachability to a specific service port (gates exploitation of a listening service).

Source can cause the target to execute (event source, schedule). Includes triggering compute workloads and orchestration workflows. AnalyticsService sources cover analytics engines that invoke compute as part of query execution (e.g. an Athena federated query invoking its Lambda data-source connector).

Recon: resource references another (connection targets, IaC). Aids collection, not traversal. Network sources (e.g., Route 53 DNS zones) reference alias targets like ELB/CloudFront/S3; dangling aliases are a legitimate structural relationship.

Reachable only via private networking (PrivateLink/PE/PSC) - needs a foothold in-network. Includes private APIs and messaging endpoints accessible only via interface endpoints, and object storage reached via a private/gateway endpoint (Azure Blob/Files PE, GCS via PSC). Network sources cover the endpoint/distribution itself acting as the reachability actor (e.g. a CloudFront distribution's OAC/OAI reaching a private S3 origin, or a Private Endpoint node).