brief

# Lab: `cross_account_trust`

b2b_saas / medium / `partner-exchange` · prod

## Your job

An external AWS account is trusted into this environment. Which role does it land in, and what can that role reach from there?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n32_9510/acct-external`: **Account** partner-account-9510
- `n20_9510/acct-main`: **Account** prod-account-9510
- `n38_9510/role-shared`: **IAMRole** SharedRole-9510
- `n04_9510/pol-shared-s3read`: **IAMPolicy** SharedS3ReadPolicy-9510
- `n16_9510/s3-partner-data`: **S3Bucket** partner-exchange-9510
- `n19_9510/s3-locked-backups`: **S3Bucket** public-looking-backups-9510
- `n27_9510/app-partner-exchange`: **Application** partner-exchange-9510
- `n35_9510/data-partner`: **DataSet** partner-records-9510
- `n21_9510/trail-main`: **LogTrail** main-trail-9510
- `n22_9510/role-partner-sync`: **IAMRole** PartnerSyncRole-9510
- `n07_9510/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-9510
- `n40_9510/role-partner-sync`: **IAMRole** PartnerSyncRole-2-9510
- `n30_9510/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-2-9510
- `n14_9510/role-legacy-support`: **IAMRole** LegacySupportRole-9510
- `n03_9510/pol-legacy-support-read`: **IAMPolicy** LegacySupportReadPolicy-9510
- `n25_9510/s3-release-downloads`: **S3Bucket** release-downloads-9510
- `n08_9510/s3-marketing-downloads`: **S3Bucket** marketing-downloads-9510
- `n06_9510/s3-audit-evidence`: **S3Bucket** audit-evidence-9510
- `n33_9510/trail-audit-evidence`: **LogTrail** trail-audit-evidence-9510
- `n36_9510/data-audit-evidence`: **DataSet** audit-evidence-files-9510
- `n05_9510/data-operational-metrics`: **DataSet** data-operational-metrics-9510
- `n37_9510/kms-app-configs`: **KmsKey** kms-app-configs-9510
- `n18_9510/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-9510
- `n26_9510/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-2-9510
- `n15_9510/s3-media-cache`: **S3Bucket** media-cache-9510
- `n28_9510/s3-media-cache`: **S3Bucket** media-cache-2-9510
- `n13_9510/s3-backup-vault`: **S3Bucket** backup-vault-9510
- `n24_9510/trail-security-secondary`: **LogTrail** trail-security-secondary-9510
- `n02_9510/role-metrics-collector`: **IAMRole** MetricsCollectorRole-9510
- `n10_9510/data-reporting-store`: **DataSet** data-reporting-store-9510
- `n17_9510/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-9510
- `n31_9510/trail-audit-operations`: **LogTrail** trail-audit-operations-9510
- `n01_9510/kms-app-configs`: **KmsKey** kms-app-configs-2-9510
- `n29_9510/s3-assets-archive`: **S3Bucket** assets-archive-9510
- `n11_9510/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-9510
- `n23_9510/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-9510
- `n39_9510/ecr-utility-image`: **EcrRepository** repo-utility-image-9510
- `n09_9510/ecr-base-runner`: **EcrRepository** repo-base-runner-9510
- `n12_9510/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-2-9510
- `n34_9510/trail-infra-events`: **LogTrail** trail-infra-events-9510
- `n00_9510/data-operational-metrics`: **DataSet** data-operational-metrics-2-9510

## Relationships

- `n32_9510/acct-external` --assumes--> `n38_9510/role-shared`
- `n38_9510/role-shared` --attached_policy--> `n04_9510/pol-shared-s3read`
- `n38_9510/role-shared` --can_read--> `n16_9510/s3-partner-data`
- `n16_9510/s3-partner-data` --stores_sensitive_data--> `n35_9510/data-partner`
- `n16_9510/s3-partner-data` --belongs_to_app--> `n27_9510/app-partner-exchange`
- `n19_9510/s3-locked-backups` --belongs_to_app--> `n27_9510/app-partner-exchange`
- `n22_9510/role-partner-sync` --attached_policy--> `n07_9510/pol-partner-sync-read`
- `n40_9510/role-partner-sync` --attached_policy--> `n30_9510/pol-partner-sync-read`
- `n14_9510/role-legacy-support` --attached_policy--> `n03_9510/pol-legacy-support-read`
- `n06_9510/s3-audit-evidence` --logs_to--> `n33_9510/trail-audit-evidence`
- `n06_9510/s3-audit-evidence` --stores_sensitive_data--> `n36_9510/data-audit-evidence`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub