wallarm
Search Wallarm ⌘K Tenant Name 12345

Infrastructure discovery

OverviewGraphSecuritySettings
Potential attack paths 7
Internet → bastion → customer-db
3 hops · CRITICAL · breaks 4 paths
Internet → bastion → secrets
2 hops · CRITICAL
Internet → bastion → s3-backups
3 hops · HIGH
Internet → bastion → rds-replica
2 hops · HIGH
Internet → web-alb → web-01
2 hops · HIGH
Internet → web-alb → staging-web
2 hops · MEDIUM
Internet → web-alb → access-logs
3 hops · LOW
Analyzing topology…
tracing exposure to sensitive assets
All accounts 2 regions 65 assets
CRITICAL Potential attack path 1 of 7
Internet → EC2 bastion → EKS cluster → customer-db · breaks 4 paths
TopologyAttack paths
secrets CRITICAL · 2 hops rds-replica HIGH · 2 hops s3-backups HIGH · 3 hops 1 2 3 Internet entry point 3 EC2 bastion public · SSH open In 4 paths 2 EKS cluster prod-cluster customer-db crown jewel · PII
selected path other paths — click to switch crown jewel
Attack path · selected
CRITICAL breaks 4 paths
Internet → EC2 bastion → EKS cluster → customer-db · 3 hops

Why it matters

A public security group on EC2 bastion lets an attacker reach customer PII and secrets in as few as 2 hops.

The choke point

sg-prod-web-open
SSH open to 0.0.0.0/0 · security group

Underlying findings · 3

CRITSG_ALL_TRAFFIC
HIGHSG_OPEN_SSH
MEDSG_UNUSED_RULE

Provenance · CloudTrail

Created by@deploy-bot
API callCreateSecurityGroup
Source IP203.0.113.9
When3 days ago

Remediation

  1. Replace the 0.0.0.0/0 rule with your VPN CIDR.
  2. Restrict port 22 to the bastion range only.