attack-path-analysis

Attack path analysis (MITRE ATT&CK)

Explain how an adversary could realistically compromise a scanned AWS account, as chained attack paths mapped to MITRE ATT&CK tactics and techniques — not an unordered list of findings.

The value is the chain: an internet-reachable instance is only the entry point; the risk is what it leads to (a permissive role, an unencrypted database, a public bucket). Build paths from entry to impact.

Tools

Gather the raw material, then correlate it:

• analyze_service_exposure — the internet-reachable surface (EC2, Lambda, databases, entry points) with evidence chains. The entry points.
• get_security_assessment_data — the full findings set across identity, network, data, logging, service exposure. The weaknesses to chain.
• analyze_iam_permissions — over-privileged users/roles, admin/wildcard grants, missing MFA, stale keys. Returns {summary, findings}. The escalation and lateral-movement fuel.
• find_public_ec2_instances, find_publicly_accessible_databases, find_public_s3_buckets — specific exposed resources for concrete paths.
• find_security_group_violations — the network reachability that connects steps.
• get_iam_users — MFA and credential state for initial-access realism.

Workflow

1. Resolve the scan

Latest scan unless the user names one (list_scans accepts account_number). State the account and scan date.

2. Enumerate the ingredients by tactic

Load references/attack-technique-map.md. Sort the findings into ATT&CK tactics using it:

• Initial Access — internet-reachable instances/functions/databases, public entry points, users without MFA.
• Privilege Escalation / Credential Access — instance roles and users with broad or wildcard IAM, stale access keys, root weaknesses, unsecured credentials.
• Lateral Movement — permissive internal security groups, network connectivity, shared roles.
• Collection / Exfiltration / Impact — public or unencrypted data stores, public buckets, missing logging that would hide the activity.