Synthèse
Most AWS security tooling asks a configuration question: Is this policy overly permissive? Does this role violate best practice? Those are undoubtedly useful questions, but they are also incomplete for understanding real compromise risk. The question an attacker asks is different. An attacker does not care whether a policy is “overly permissive.” They care whether the one they compromised, via an exposed EC2 instance, lambda function, or CI/CD compromise, can reach a sensitive resource. Can they
Most AWS security tooling asks a configuration question: Is this policy overly permissive? Does this role violate best practice? Those are undoubtedly useful questions, but they are also incomplete for understanding real compromise risk. The question an attacker asks is different. An attacker does not care whether a policy is “overly permissive.
” They care whether the one they compromised, via an exposed EC2 instance, lambda function, or CI/CD compromise, can reach a sensitive resource. Can they reach the role with an administrator policy? The lambda function with production credentials? They care about the chain, not just about the control Bloodhound Enterprise now has a solution for that AWS question. It evaluates the full AWS authorization model—identity, resource, trust, permission boundary, SCP and RCP policies together—and renders it as traversable attack paths.
Meticulous consideration for the policy evaluation pipeline produces real, accurate edges that give a clear picture of who can do what.