How to Visualize the Blast Radius of a Resource

Fix Inventory builds a cloud asset inventory by collecting resource metadata and relationships.

Fix Inventory uses resource relationship data to traverse not only the direct dependencies of a resource, but also transitive dependencies (the dependencies of dependent resources).

Transitive dependencies show the "blast radius" of a resource, giving an overview how a resource is connected to other resources. In the event that a resource becomes compromised, the blast radius can provide a complete view of affected resources.

Prerequisites

This guide assumes that you have already installed and configured Fix Inventory to collect your cloud resources.

Directions

1. Execute the search command in Fix Inventory Shell to get the resource for which we want to see the blast radius:

   > search is(aws_ec2_instance) and name=teamcity-production
   ​kind=aws_ec2_instance, id=i-1xx, name=teamcity-production, age=1yr7mo, cloud=aws, account=prod, region=us-west-2​

   The above example searches for an AWS EC2 instance with name teamcity-production.

   note

   Make sure the search only returns a single result, the resource we are interested in.

2. Add -[0:]-> to the end of the search query to instruct Fix Inventory to traverse dependencies outbound:

   > search is(aws_ec2_instance) and name=teamcity-production -[0:]->
    ​kind=aws_ec2_instance, id=i-1xx, name=teamcity-production, age=1yr7mo, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_cloudwatch_alarm, id=high-cpu-utlization, name=high-cpu-utlization, age=1yr7mo, last_update=1yr7mo, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_keypair, id=key-07xx, name=teamcity-17, age=4mo13d, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_network_interface, id=eni-0exx, name=eni-0exx, age=4mo13d, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_snapshot, id=snap-0e2xx, name=snap-0e2xx, age=7mo25d, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_snapshot, id=snap-0f1xx, name=snap-0f1xx, age=8mo15d, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_snapshot, id=snap-0f3xx, name=snap-0f3xx, age=6mo14d, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_snapshot, id=snap-00dxx, name=TeamcityBackup, age=9mo19d, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_volume, id=vol-0acxx, name=vol-0acxx, age=1yr7mo, cloud=aws, account=prod, region=us-west-2
    ​kind=aws_ec2_volume, id=vol-0ebxx, name=vol-0ebxx, age=1yr7mo, cloud=aws, account=prod, region=us-west-2

3. Export the results in Graphviz DOT format:

   > search --with-edges is(aws_ec2_instance) and name=teamcity-production -[0:]-> | format --dot | write blast-radius.dot
   ​Received a file blast-radius.dot, which is stored to ./blast-radius.dot.

   The resulting file is outputted to the Fix Inventory Shell download directory, which defaults to the current working directory. Use a Graphviz tool to visualize the results:

   $ dot -Tsvg blast-radius.dot -o blast-radius.svg

   The above outputs an image in SVG format:

   

Further Reading

• Search
• Command-Line Interface