Skip to main content
Version: 4.0.4

How to Visualize the Blast Radius of a Resource

Fix Inventory builds a cloud asset inventory by collecting resource metadata and relationships.

Fix Inventory uses resource relationship data to traverse not only the direct dependencies of a resource, but also transitive dependencies (the dependencies of dependent resources).

Transitive dependencies show the "blast radius" of a resource, giving an overview how a resource is connected to other resources. In the event that a resource becomes compromised, the blast radius can provide a complete view of affected resources.


This guide assumes that you have already installed and configured Fix Inventory to collect your cloud resources.


  1. Execute the search command in Fix Inventory Shell to get the resource for which we want to see the blast radius:

    > search is(aws_ec2_instance) and name=teamcity-production
    ‚Äčkind=aws_ec2_instance, id=i-1xx, name=teamcity-production, age=1yr7mo, cloud=aws, account=prod, region=us-west-2‚Äč

    The above example searches for an AWS EC2 instance with name teamcity-production.


    Make sure the search only returns a single result, the resource we are interested in.

  2. Add -[0:]-> to the end of the search query to instruct Fix Inventory to traverse dependencies outbound:

    > search is(aws_ec2_instance) and name=teamcity-production -[0:]->
    ‚Äčkind=aws_ec2_instance, id=i-1xx, name=teamcity-production, age=1yr7mo, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_cloudwatch_alarm, id=high-cpu-utlization, name=high-cpu-utlization, age=1yr7mo, last_update=1yr7mo, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_keypair, id=key-07xx, name=teamcity-17, age=4mo13d, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_network_interface, id=eni-0exx, name=eni-0exx, age=4mo13d, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_snapshot, id=snap-0e2xx, name=snap-0e2xx, age=7mo25d, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_snapshot, id=snap-0f1xx, name=snap-0f1xx, age=8mo15d, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_snapshot, id=snap-0f3xx, name=snap-0f3xx, age=6mo14d, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_snapshot, id=snap-00dxx, name=TeamcityBackup, age=9mo19d, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_volume, id=vol-0acxx, name=vol-0acxx, age=1yr7mo, cloud=aws, account=prod, region=us-west-2
    ‚Äčkind=aws_ec2_volume, id=vol-0ebxx, name=vol-0ebxx, age=1yr7mo, cloud=aws, account=prod, region=us-west-2
  3. Export the results in Graphviz DOT format:

    > search --with-edges is(aws_ec2_instance) and name=teamcity-production -[0:]-> | format --dot | write
    ‚ÄčReceived a file, which is stored to ./

    The resulting file is outputted to the Fix Inventory Shell download directory, which defaults to the current working directory. Use a Graphviz tool to visualize the results:

    $ dot -Tsvg -o blast-radius.svg

    The above outputs an image in SVG format:

    Diagram illustrating blast radius

Further Reading‚Äč