blast_radius¶
Category graph · sensitivity confidential · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)
What is affected if one asset breaks, changes, is deleted or is compromised, from two angles.
| Argument | Type | Default | Constraints | Description |
|---|---|---|---|---|
ref |
string | required | min length 1 | Asset reference: internal id, ARN / cloud resource id, unique name, or unique ARN tail (e.g. 'function:api' or 'i-0abc'). |
max_depth |
integer | 10 |
1..15 | Depth limit for the dependency walk. |
limit |
integer | 50 |
1..500 | Cap on dependency.items and network.sensitive_reachable. |
dataset |
string | "" |
Dataset name (see list_datasets). Empty = the active dataset. |
dependency is the availability view: every transitive dependent up to max_depth, with transitive_dependents, by_depth (count per depth, keys are strings), accounts_affected, internet_exposed_dependents, items (asset brief plus via edge type, relationship, depth and parent_id, at most limit) and truncated. network is the reach view: reachable_assets (assets that are descendants in the relationship graph), max_depth (depth of the breadth-first tree), risk_score (see Risk scores) and sensitive_reachable (crown-jewel assets among them, at most limit). Links the asset.
A KMS key has many dependents and reaches nothing:
Called with the arguments below, blast_radius returned this structuredContent.
{
"dataset": "sample",
"asset": {
"id": "kms-main",
"name": "prod-main-key",
"type": "KMS_KEY",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:kms:us-east-1:111111111111:key/1111-2222",
"internet_exposed": false,
"open_findings": 0,
"max_severity": null,
"uri": "cloudg://assets/kms-main"
},
"dependency": {
"transitive_dependents": 12,
"by_depth": {
"1": 4,
"2": 3,
"3": 3,
"4": 1,
"5": 1
},
"accounts_affected": [
"111111111111"
],
"internet_exposed_dependents": 2,
"items": [
{
"id": "api-handler",
"name": "api-handler",
"type": "LAMBDA_FUNCTION",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:lambda:us-east-1:111111111111:function:api-handler",
"internet_exposed": false,
"open_findings": 1,
"max_severity": "LOW",
"uri": "cloudg://assets/api-handler",
"via": "REFERENCES",
"relationship": "ENCRYPTED_BY_KMS",
"depth": 1,
"parent_id": "kms-main"
},
{
"id": "data-bucket",
"name": "prod-data",
"type": "S3_BUCKET",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:s3:::prod-data",
"internet_exposed": false,
"open_findings": 0,
"max_severity": null,
"uri": "cloudg://assets/data-bucket",
"via": "REFERENCES",
"relationship": "ENCRYPTED_BY_KMS",
"depth": 1,
"parent_id": "kms-main"
},
{
"id": "orders-db",
"name": "orders-db",
"type": "RDS_INSTANCE",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:rds:us-east-1:111111111111:db:orders-db",
"internet_exposed": false,
"open_findings": 1,
"max_severity": "MEDIUM",
"uri": "cloudg://assets/orders-db",
"via": "REFERENCES",
"relationship": "ENCRYPTED_BY_KMS",
"depth": 1,
"parent_id": "kms-main"
}
],
"truncated": true
},
"network": {
"reachable_assets": 0,
"max_depth": 0,
"risk_score": 0.0,
"sensitive_reachable": []
}
}
The result also carried these resource links in content:
[
{
"type": "resource_link",
"uri": "cloudg://assets/kms-main",
"name": "prod-main-key",
"mimeType": "application/json"
}
]
A role is the opposite:
Called with the arguments below, blast_radius returned this structuredContent.
{
"dataset": "sample",
"asset": {
"id": "app-role",
"name": "app-role",
"type": "IAM_ROLE",
"provider": "AWS",
"region": "global",
"account_id": "111111111111",
"arn": "arn:aws:iam::111111111111:role/app-role",
"internet_exposed": false,
"open_findings": 0,
"max_severity": null,
"uri": "cloudg://assets/app-role"
},
"dependency": {
"transitive_dependents": 4,
"by_depth": {
"1": 2,
"2": 1,
"3": 1
},
"accounts_affected": [
"111111111111"
],
"internet_exposed_dependents": 1,
"items": [
{
"id": "web-1",
"name": "web-1",
"type": "EC2",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:ec2:us-east-1:111111111111:instance/i-0web1",
"internet_exposed": false,
"open_findings": 1,
"max_severity": "HIGH",
"uri": "cloudg://assets/web-1",
"via": "ASSUMES_ROLE",
"relationship": null,
"depth": 1,
"parent_id": "app-role"
},
{
"id": "web-2",
"name": "web-2",
"type": "EC2",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:ec2:us-east-1:111111111111:instance/i-0web2",
"internet_exposed": false,
"open_findings": 0,
"max_severity": null,
"uri": "cloudg://assets/web-2",
"via": "ASSUMES_ROLE",
"relationship": null,
"depth": 1,
"parent_id": "app-role"
},
"... 2 more"
],
"truncated": false
},
"network": {
"reachable_assets": 11,
"max_depth": 4,
"risk_score": 7.5,
"sensitive_reachable": [
{
"id": "artifacts-bucket",
"name": "shared-artifacts",
"type": "S3_BUCKET",
"provider": "AWS",
"region": "eu-west-1",
"account_id": "222222222222",
"arn": "arn:aws:s3:::shared-artifacts",
"internet_exposed": false,
"open_findings": 0,
"max_severity": null,
"uri": "cloudg://assets/artifacts-bucket"
},
{
"id": "data-bucket",
"name": "prod-data",
"type": "S3_BUCKET",
"provider": "AWS",
"region": "us-east-1",
"account_id": "111111111111",
"arn": "arn:aws:s3:::prod-data",
"internet_exposed": false,
"open_findings": 0,
"max_severity": null,
"uri": "cloudg://assets/data-bucket"
},
"... 3 more"
]
}
}
Related: dependents, dependency_tree, lateral_movement_paths(start=...), the blast_radius_assessment prompt.