cross_account_edges

Graph · From docs/MCP_TOOLS.md on GitHub

Category graph · sensitivity confidential · capabilities read_state · readOnly true, destructive false, idempotent true, openWorld false · outputSchema no · timeout: layer default (300 s)

Relationships whose two ends are in different accounts, subscriptions or projects: trust, grants, image pulls, peering, shared resources. Rows come from cloudg.inventory.dependencies.cross_account_edges and identify endpoints by ARN (or id when there is none), not by internal id: source, source_account, target, target_account, edge_type, relationship, external (true when one side is an account outside the mapped estate). by_account_pair counts every matching row, not just the page.

Argument	Type	Default	Constraints	Description
account_id	string	""		Only edges touching this account.
external_only	boolean	false		Only edges to accounts outside the mapped estate.
edge_types	string[] or null	null		Only these EdgeType values.
limit	integer	50	1..500	Maximum items to return.
cursor	string	""		Opaque cursor from a previous call's next_cursor; empty = first page.
dataset	string	""		Dataset name (see list_datasets). Empty = the active dataset.

Called with the arguments below, cross_account_edges returned this structuredContent.

{}

{
  "dataset": "sample",
  "total": 3,
  "offset": 0,
  "returned": 3,
  "next_cursor": null,
  "truncated": false,
  "by_account_pair": {
    "111111111111 -> 222222222222": 2,
    "999999999999 -> 222222222222": 1
  },
  "items": [
    {
      "source": "arn:aws:iam::111111111111:role/app-role",
      "source_account": "111111111111",
      "target": "arn:aws:iam::222222222222:role/deploy-role",
      "target_account": "222222222222",
      "edge_type": "IAM_TRUST",
      "relationship": "CROSS_ACCOUNT_TRUST",
      "external": false
    },
    {
      "source": "arn:aws:iam::999999999999:root",
      "source_account": "999999999999",
      "target": "arn:aws:iam::222222222222:role/deploy-role",
      "target_account": "222222222222",
      "edge_type": "IAM_TRUST",
      "relationship": "CROSS_ACCOUNT_TRUST",
      "external": true
    },
    {
      "source": "arn:aws:lambda:us-east-1:111111111111:function:api-handler",
      "source_account": "111111111111",
      "target": "arn:aws:ecr:eu-west-1:222222222222:repository/app-images",
      "target_account": "222222222222",
      "edge_type": "USES_IMAGE",
      "relationship": null,
      "external": false
    }
  ]
}

Called with the arguments below, cross_account_edges returned this structuredContent.

{"external_only": true}

{
  "dataset": "sample",
  "total": 1,
  "offset": 0,
  "returned": 1,
  "next_cursor": null,
  "truncated": false,
  "by_account_pair": {
    "999999999999 -> 222222222222": 1
  },
  "items": [
    {
      "source": "arn:aws:iam::999999999999:root",
      "source_account": "999999999999",
      "target": "arn:aws:iam::222222222222:role/deploy-role",
      "target_account": "222222222222",
      "edge_type": "IAM_TRUST",
      "relationship": "CROSS_ACCOUNT_TRUST",
      "external": true
    }
  ]
}

Related: get_edges(cross_account_only=true), lateral_movement_paths, organization_topology.