# Lab: `public_rds_instance` b2b_saas / medium / `billing-database` · prod ## Your job A production relational database has been deployed. Can the database itself be reached from the internet, or is it isolated in private subnets? For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database. ## Resources - `n16_a524/acct-main`: **Account** prod-account-a524 - `n42_a524/sg-rds-public`: **SecurityGroup** public-db-sg-a524 - `n39_a524/rds-customer-db`: **RdsInstance** customer-financials-db-a524 - `n43_a524/s3-financials-archive`: **S3Bucket** customer-financials-archive-a524 - `n30_a524/data-customer-financials`: **DataSet** customer-financial-transactions-a524 - `n04_a524/s3-press-kit`: **S3Bucket** press-kit-downloads-a524 - `n37_a524/role-export-service`: **IAMRole** ExportServiceRole-a524 - `n01_a524/pol-export-service`: **IAMPolicy** ExportServicePolicy-a524 - `n19_a524/role-partner-sync`: **IAMRole** PartnerSyncRole-a524 - `n45_a524/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-a524 - `n02_a524/s3-marketing-downloads`: **S3Bucket** marketing-downloads-a524 - `n33_a524/s3-release-downloads`: **S3Bucket** release-downloads-a524 - `n08_a524/s3-ops-runbooks`: **S3Bucket** ops-runbooks-a524 - `n44_a524/trail-ops-runbooks`: **LogTrail** trail-ops-runbooks-a524 - `n09_a524/data-ops-runbooks`: **DataSet** runbook-library-a524 - `n31_a524/s3-partner-uploads`: **S3Bucket** partner-uploads-a524 - `n34_a524/trail-partner-uploads`: **LogTrail** trail-partner-uploads-a524 - `n21_a524/data-partner-uploads`: **DataSet** partner-upload-files-a524 - `n41_a524/s3-app-config`: **S3Bucket** app-config-store-a524 - `n40_a524/trail-app-config`: **LogTrail** trail-app-config-a524 - `n25_a524/data-app-config`: **DataSet** app-config-values-a524 - `n38_a524/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-a524 - `n32_a524/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-a524 - `n07_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-a524 - `n27_a524/kms-storage-general`: **KmsKey** kms-storage-general-a524 - `n24_a524/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-a524 - `n03_a524/trail-infra-events`: **LogTrail** trail-infra-events-a524 - `n14_a524/data-reporting-store`: **DataSet** data-reporting-store-a524 - `n18_a524/trail-security-secondary`: **LogTrail** trail-security-secondary-a524 - `n17_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-2-a524 - `n36_a524/s3-assets-archive`: **S3Bucket** assets-archive-a524 - `n06_a524/trail-infra-events`: **LogTrail** trail-infra-events-2-a524 - `n22_a524/sqs-notifications-stream`: **SqsQueue** notifications-stream-a524 - `n10_a524/data-reporting-store`: **DataSet** data-reporting-store-2-a524 - `n46_a524/trail-infra-events`: **LogTrail** trail-infra-events-3-a524 - `n28_a524/s3-exports-staging`: **S3Bucket** exports-staging-a524 - `n00_a524/role-metrics-collector`: **IAMRole** MetricsCollectorRole-a524 - `n26_a524/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-a524 - `n12_a524/sqs-ingest-pipeline`: **SqsQueue** ingest-pipeline-a524 - `n35_a524/data-operational-metrics`: **DataSet** data-operational-metrics-a524 - `n05_a524/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-2-a524 - `n23_a524/sqs-audit-events`: **SqsQueue** audit-events-a524 - `n29_a524/kms-storage-general`: **KmsKey** kms-storage-general-2-a524 - `n15_a524/data-reporting-store`: **DataSet** data-reporting-store-3-a524 - `n13_a524/data-reporting-store`: **DataSet** data-reporting-store-4-a524 - `n11_a524/ecr-base-runner`: **EcrRepository** repo-base-runner-a524 - `n20_a524/ecr-utility-image`: **EcrRepository** repo-utility-image-3-a524 ## Relationships - `n16_a524/acct-main` --exposed_to_internet--> `n39_a524/rds-customer-db` - `n39_a524/rds-customer-db` --has_security_group--> `n42_a524/sg-rds-public` - `n43_a524/s3-financials-archive` --stores_sensitive_data--> `n30_a524/data-customer-financials` - `n16_a524/acct-main` --exposed_to_internet--> `n04_a524/s3-press-kit` - `n37_a524/role-export-service` --attached_policy--> `n01_a524/pol-export-service` - `n37_a524/role-export-service` --can_read--> `n39_a524/rds-customer-db` - `n19_a524/role-partner-sync` --attached_policy--> `n45_a524/pol-partner-sync-read` - `n08_a524/s3-ops-runbooks` --logs_to--> `n44_a524/trail-ops-runbooks` - `n08_a524/s3-ops-runbooks` --stores_sensitive_data--> `n09_a524/data-ops-runbooks` - `n31_a524/s3-partner-uploads` --logs_to--> `n34_a524/trail-partner-uploads` - `n31_a524/s3-partner-uploads` --stores_sensitive_data--> `n21_a524/data-partner-uploads` - `n41_a524/s3-app-config` --logs_to--> `n40_a524/trail-app-config` - `n41_a524/s3-app-config` --stores_sensitive_data--> `n25_a524/data-app-config`
This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.
The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.
cloudforge on GitHub