Dependency analysis¶
DependencyGraph turns each edge into dependent → dependency with DEPENDENCY_DIRECTION
(reference table). The rule of thumb: for
"uses" edges (references, attachment, routes, images, roles, logs, targets, grants, trust) the
source needs the target; for "acts on" edges (contains, invokes, protects, monitors, manages,
governs) the target needs the source. So a function needs its role, its image, its key, its log
group, and the queue that triggers it; an ALB needs the WAF protecting it; a resource needs the
stack managing it; an account needs the SCPs governing it.
depends_on(x)walks upstream,dependents(x)downstream (the blast radius).- Hierarchy containment is excluded by default (it says where, not what breaks).
- Security group rule, NACL rule and internet exposure edges carry no dependency meaning and are ignored.
This is an availability / change-impact view. Compromise propagation goes the other way along
identity edges (a compromised function exposes its role); for that, walk IAM_TRUST,
ASSUMES_ROLE and GRANTS_ACCESS edges directly, or use the attack path analysis of
GraphBuilder.
To change how an edge type participates, edit DEPENDENCY_DIRECTION; a new EdgeType without
an entry is ignored by dependency analysis until you add one.