# Lab: `public_data_exposure` b2b_saas / medium / `customer-data-lake` · prod ## Your job Some data in this account may be reachable from the internet. Find the exposure. Not every public-looking bucket is a true positive. For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database. ## Resources - `n16_a524/acct-main`: **Account** prod-account-a524 - `n42_a524/vpc-prod`: **VPC** prod-vpc-a524 - `n39_a524/s3-public-data`: **S3Bucket** customer-pii-a524 - `n43_a524/s3-locked-backups`: **S3Bucket** public-looking-backups-a524 - `n30_a524/app-data-lake`: **Application** customer-data-lake-a524 - `n04_a524/data-customer-pii`: **DataSet** customer-pii-records-a524 - `n37_a524/trail-main`: **LogTrail** main-trail-a524 - `n01_a524/s3-press-kit`: **S3Bucket** press-kit-downloads-a524 - `n19_a524/role-export-service`: **IAMRole** ExportServiceRole-a524 - `n45_a524/pol-export-service`: **IAMPolicy** ExportServicePolicy-a524 - `n02_a524/role-partner-sync`: **IAMRole** PartnerSyncRole-a524 - `n33_a524/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-a524 - `n08_a524/s3-marketing-downloads`: **S3Bucket** marketing-downloads-a524 - `n44_a524/s3-release-downloads`: **S3Bucket** release-downloads-a524 - `n09_a524/s3-ops-runbooks`: **S3Bucket** ops-runbooks-a524 - `n31_a524/trail-ops-runbooks`: **LogTrail** trail-ops-runbooks-a524 - `n34_a524/data-ops-runbooks`: **DataSet** runbook-library-a524 - `n21_a524/s3-partner-uploads`: **S3Bucket** partner-uploads-a524 - `n41_a524/trail-partner-uploads`: **LogTrail** trail-partner-uploads-a524 - `n40_a524/data-partner-uploads`: **DataSet** partner-upload-files-a524 - `n25_a524/s3-app-config`: **S3Bucket** app-config-store-a524 - `n38_a524/trail-app-config`: **LogTrail** trail-app-config-a524 - `n32_a524/data-app-config`: **DataSet** app-config-values-a524 - `n07_a524/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-a524 - `n27_a524/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-a524 - `n24_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-a524 - `n03_a524/kms-storage-general`: **KmsKey** kms-storage-general-a524 - `n14_a524/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-a524 - `n18_a524/trail-infra-events`: **LogTrail** trail-infra-events-a524 - `n17_a524/data-reporting-store`: **DataSet** data-reporting-store-a524 - `n36_a524/trail-security-secondary`: **LogTrail** trail-security-secondary-a524 - `n06_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-2-a524 - `n22_a524/s3-assets-archive`: **S3Bucket** assets-archive-a524 - `n10_a524/trail-infra-events`: **LogTrail** trail-infra-events-2-a524 - `n46_a524/sqs-notifications-stream`: **SqsQueue** notifications-stream-a524 - `n28_a524/data-reporting-store`: **DataSet** data-reporting-store-2-a524 - `n00_a524/trail-infra-events`: **LogTrail** trail-infra-events-3-a524 - `n26_a524/s3-exports-staging`: **S3Bucket** exports-staging-a524 - `n12_a524/role-metrics-collector`: **IAMRole** MetricsCollectorRole-a524 - `n35_a524/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-a524 - `n05_a524/sqs-ingest-pipeline`: **SqsQueue** ingest-pipeline-a524 - `n23_a524/data-operational-metrics`: **DataSet** data-operational-metrics-a524 - `n29_a524/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-2-a524 - `n15_a524/sqs-audit-events`: **SqsQueue** audit-events-a524 - `n13_a524/kms-storage-general`: **KmsKey** kms-storage-general-2-a524 - `n11_a524/data-reporting-store`: **DataSet** data-reporting-store-3-a524 - `n20_a524/data-reporting-store`: **DataSet** data-reporting-store-4-a524 ## Relationships - `n16_a524/acct-main` --exposed_to_internet--> `n39_a524/s3-public-data` - `n39_a524/s3-public-data` --stores_sensitive_data--> `n04_a524/data-customer-pii` - `n39_a524/s3-public-data` --belongs_to_app--> `n30_a524/app-data-lake` - `n43_a524/s3-locked-backups` --belongs_to_app--> `n30_a524/app-data-lake` - `n16_a524/acct-main` --exposed_to_internet--> `n43_a524/s3-locked-backups` - `n16_a524/acct-main` --exposed_to_internet--> `n01_a524/s3-press-kit` - `n19_a524/role-export-service` --attached_policy--> `n45_a524/pol-export-service` - `n19_a524/role-export-service` --can_read--> `n39_a524/s3-public-data` - `n02_a524/role-partner-sync` --attached_policy--> `n33_a524/pol-partner-sync-read` - `n09_a524/s3-ops-runbooks` --logs_to--> `n31_a524/trail-ops-runbooks` - `n09_a524/s3-ops-runbooks` --stores_sensitive_data--> `n34_a524/data-ops-runbooks` - `n21_a524/s3-partner-uploads` --logs_to--> `n41_a524/trail-partner-uploads` - `n21_a524/s3-partner-uploads` --stores_sensitive_data--> `n40_a524/data-partner-uploads` - `n25_a524/s3-app-config` --logs_to--> `n38_a524/trail-app-config` - `n25_a524/s3-app-config` --stores_sensitive_data--> `n32_a524/data-app-config`
This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.
The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.
cloudforge on GitHub