Multi-Cloud Attack Path Engine & Blast Radius Visualizer

Flagship Differentiator: Chained Exploit Simulation across AWS STS, Azure RBAC, GCP Service Accounts & Kubernetes

Internet ALB -> SSRF -> EC2 Instance Profile -> iam:PassRole -> Production RDS DB Takeover

DEPTH: 5 HOPS

NODE 01 · INTERNET_EXPOSURERisk: 75/100

Public ALB / Ingress

Publicly accessible endpoint (0.0.0.0/0)

NODE 02 · COMPROMISED_IDENTITYRisk: 88/100

EC2 App Node (IMDSv1 Open)

IMDSv1 enabled allowing unauthenticated SSRF token theft

NODE 03 · IAM_ROLERisk: 80/100

Instance Profile: AppRole

Attached role possesses iam:PassRole over AdminLambda

NODE 04 · PRIVILEGE_ESCALATIONRisk: 98/100

PrivEsc: iam:PassRole -> Lambda

Attacker passes AdministratorAccess role to Lambda function

NODE 05 · CROWN_JEWELRisk: 100/100

Production Aurora RDS DB

Holds 4.2M encrypted customer credit cards & HIPAA records

Estimated Blast Radius

$4.2M Data Exfiltration & Complete Database Wipe

Exploit Feasibility: TRIVIAL. An adversary entering through Public ALB (app.expediteconsults.com:443) can leverage the intermediate IAM privilege escalations to assume unrestricted administrative control over aurora-prod-customer-db.c12x.rds.amazonaws.com (Encrypted PII).

Choke-Point IaC Remediation

Remove iam:PassRole on app-workload-role & Enforce IMDSv2 (Hop Limit 1)

# Terraform Automated Choke-point Fix
resource "aws_instance" "app_server" {
  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required" # Enforces IMDSv2
    http_put_response_hop_limit = 1
  }
}

# Restrict iam:PassRole to specific non-admin ARNs