# Lab: `ci_cd_iam_chain` b2b_saas / small / `analytics-exporter` · staging ## Your job A CI identity deploys into this account. Can it reach sensitive customer data? Which issues are real, and which look worse than they are? For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database. ## Resources - `n21_60c7/acct-main`: **Account** staging-account-60c7 - `n03_60c7/vpc-staging`: **VPC** staging-vpc-60c7 - `n15_60c7/subnet-public-a`: **Subnet** public-a-60c7 - `n02_60c7/sg-web`: **SecurityGroup** web-sg-60c7 - `n24_60c7/cicd-github`: **CICDIdentity** github-actions-oidc-60c7 - `n27_60c7/role-deploy`: **IAMRole** DeployRole-60c7 - `n17_60c7/role-runtime`: **IAMRole** RuntimeRole-60c7 - `n29_60c7/pol-deploy-passrole`: **IAMPolicy** DeployPassRolePolicy-60c7 - `n25_60c7/pol-runtime-s3read`: **IAMPolicy** RuntimeS3ReadPolicy-60c7 - `n04_60c7/s3-customer-exports`: **S3Bucket** customer-exports-60c7 - `n12_60c7/s3-public-assets`: **S3Bucket** public-assets-60c7 - `n16_60c7/app-analytics-exporter`: **Application** analytics-exporter-60c7 - `n23_60c7/data-customer-exports`: **DataSet** customer-export-data-60c7 - `n07_60c7/trail-main`: **LogTrail** main-trail-60c7 - `n11_60c7/role-partner-sync`: **IAMRole** PartnerSyncRole-60c7 - `n20_60c7/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-60c7 - `n09_60c7/s3-open-data`: **S3Bucket** open-data-exports-60c7 - `n10_60c7/s3-static-site`: **S3Bucket** static-site-assets-60c7 - `n18_60c7/s3-open-data`: **S3Bucket** open-data-exports-2-60c7 - `n08_60c7/s3-ml-features`: **S3Bucket** ml-feature-store-60c7 - `n01_60c7/trail-ml-features`: **LogTrail** trail-ml-features-60c7 - `n00_60c7/data-ml-features`: **DataSet** feature-vectors-60c7 - `n13_60c7/s3-ops-runbooks`: **S3Bucket** ops-runbooks-60c7 - `n26_60c7/trail-ops-runbooks`: **LogTrail** trail-ops-runbooks-60c7 - `n30_60c7/data-ops-runbooks`: **DataSet** runbook-library-60c7 - `n19_60c7/s3-partner-uploads`: **S3Bucket** partner-uploads-60c7 - `n14_60c7/trail-partner-uploads`: **LogTrail** trail-partner-uploads-60c7 - `n06_60c7/data-partner-uploads`: **DataSet** partner-upload-files-60c7 - `n31_60c7/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-60c7 - `n28_60c7/kms-app-configs`: **KmsKey** kms-app-configs-60c7 - `n05_60c7/trail-infra-events`: **LogTrail** trail-infra-events-60c7 - `n22_60c7/s3-build-artifacts`: **S3Bucket** build-artifacts-60c7 ## Relationships - `n24_60c7/cicd-github` --assumes--> `n27_60c7/role-deploy` - `n27_60c7/role-deploy` --attached_policy--> `n29_60c7/pol-deploy-passrole` - `n17_60c7/role-runtime` --attached_policy--> `n25_60c7/pol-runtime-s3read` - `n17_60c7/role-runtime` --can_read--> `n04_60c7/s3-customer-exports` - `n04_60c7/s3-customer-exports` --stores_sensitive_data--> `n23_60c7/data-customer-exports` - `n16_60c7/app-analytics-exporter` --deployed_by--> `n24_60c7/cicd-github` - `n04_60c7/s3-customer-exports` --belongs_to_app--> `n16_60c7/app-analytics-exporter` - `n02_60c7/sg-web` --exposed_to_internet--> `n15_60c7/subnet-public-a` - `n15_60c7/subnet-public-a` --belongs_to_app--> `n16_60c7/app-analytics-exporter` - `n12_60c7/s3-public-assets` --exposed_to_internet--> `n15_60c7/subnet-public-a` - `n27_60c7/role-deploy` --linked-role--> `n17_60c7/role-runtime` - `n11_60c7/role-partner-sync` --attached_policy--> `n20_60c7/pol-partner-sync-read` - `n08_60c7/s3-ml-features` --logs_to--> `n01_60c7/trail-ml-features` - `n08_60c7/s3-ml-features` --stores_sensitive_data--> `n00_60c7/data-ml-features` - `n13_60c7/s3-ops-runbooks` --logs_to--> `n26_60c7/trail-ops-runbooks` - `n13_60c7/s3-ops-runbooks` --stores_sensitive_data--> `n30_60c7/data-ops-runbooks` - `n19_60c7/s3-partner-uploads` --logs_to--> `n14_60c7/trail-partner-uploads` - `n19_60c7/s3-partner-uploads` --stores_sensitive_data--> `n06_60c7/data-partner-uploads`
This estate was composed on the server in 16 ms from a scenario spec: seed 6571, one of 10,000 per family, 15 families. No cloud account was touched; the graph is the source of truth.
The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.
cloudforge on GitHub