Performing Cloud Asset Inventory With Cartography

Performing Cloud Asset Inventory with Cartography

Overview

Cartography is a CNCF sandbox project (originally created at Lyft) that consolidates infrastructure assets and their relationships into a Neo4j graph database. It queries cloud APIs to discover resources, maps relationships between them, and enables security teams to identify attack paths, generate asset reports, and find areas for security improvement. The graph model reveals hidden connections such as IAM permission chains, network paths, and cross-account trust relationships.

When to Use

• When conducting security assessments that involve performing cloud asset inventory with cartography
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Detection Gaps & Validation

• A partial sync looks like a complete graph: Cartography only ingests the modules and accounts you configure, and silently drops resources it lacks permission to read. Validate completeness by comparing node counts to ground truth, e.g. MATCH (b:S3Bucket) RETURN count(b) against aws s3api list-buckets, and MATCH (a:AWSAccount) RETURN a.id against your org account list.
• Stale nodes survive failed cleanups: nodes and relationships from a prior run linger if a sync errors mid-cleanup, producing phantom attack paths. Filter on freshness - WHERE n.lastupdated >= <run_epoch> - and discard results older than the latest sync.
• Attack-path queries miss long or unmodeled edges: a *1..5 variable-length match won't find a 6-hop path, and Cartography doesn't model every relationship (resource-based S3/KMS policies, SCPs, session policies). Widen hop limits cautiously and corroborate IAM escalation paths with PMapper.
• anonymous_access reflects sync-time ACL/policy only: it does not account for account-level S3 Block Public Access. Before reporting a public bucket, confirm with aws s3api get-public-access-block.
• Region/global confusion: IAM and S3 are global, but EC2/security-group data is per-region - a graph synced for one region under-reports network exposure.
• How to validate a finding: treat each Cypher hit as a lead, then independently reproduce it with the AWS CLI (or ScoutSuite) before it goes in a report.
• Don't treat the inventory as authoritative until node counts reconcile with the cloud APIs, every result is filtered to the latest lastupdated, and all in-scope accounts/regions are present in the graph.

Prerequisites

• Python 3.8+
• Neo4j 4.x or 5.x database
• Cloud provider credentials (AWS, GCP, Azure)
• Docker (optional, for Neo4j deployment)
• Minimum 4GB RAM for Neo4j, more for large environments

Installation

# Install Cartography
pip install cartography

# Verify installation
cartography --help

Deploy Neo4j with Docker

docker run -d \
  --name neo4j \
  -p 7474:7474 -p 7687:7687 \
  -e NEO4J_AUTH=neo4j/changethispassword \
  -e NEO4J_PLUGINS='["apoc"]' \
  -v neo4j_data:/data \
  neo4j:5-community

Running Cartography

Basic AWS Sync

# Sync AWS account data to Neo4j
cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD

Sync specific AWS modules

cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  --aws-sync-all-profiles

GCP Sync

cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  --gcp-requested-syncs compute iam storage

Security-Focused Cypher Queries

Find all S3 buckets with public access

MATCH (b:S3Bucket)
WHERE b.anonymous_access = true
   OR b.anonymous_actions IS NOT NULL
RETURN b.name, b.anonymous_actions, b.region, b.arn
ORDER BY b.name

Identify IAM users with admin policies

MATCH (user:AWSUser)-[:POLICY]->(policy:AWSPolicy)
WHERE policy.name = 'AdministratorAccess'
   OR policy.arn CONTAINS 'AdministratorAccess'
RETURN user.name, user.arn, policy.name, user.password_last_used

Find EC2 instances exposed to internet

MATCH (instance:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
      -[:MEMBER_OF_EC2_SECURITY_GROUP_RULE]->(rule:IpRule)
WHERE rule.fromport <= 22 AND rule.toport >= 22
  AND rule.protocol IN ['tcp', '-1']
  AND '0.0.0.0/0' IN rule.ipranges
RETURN instance.instanceid, instance.publicipaddress, sg.groupid, sg.name

Discover cross-account trust relationships

MATCH (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(principal:AWSPrincipal)
WHERE principal.arn CONTAINS ':root'
  AND NOT principal.arn CONTAINS role.accountid
RETURN role.arn, role.name, principal.arn AS trusted_account
ORDER BY role.name

Find attack path from public EC2 to sensitive S3

MATCH path = (instance:EC2Instance)-[:STS_ASSUME_ROLE_ALLOWS|MEMBER_OF_EC2_SECURITY_GROUP|
  POLICY|INSTANCE_PROFILE*1..5]->(bucket:S3Bucket)
WHERE instance.publicipaddress IS NOT NULL
  AND bucket.name CONTAINS 'sensitive'
RETURN path
LIMIT 25

Identify unused IAM roles

MATCH (role:AWSRole)
WHERE role.last_used IS NULL
   OR role.last_used < datetime().epochMillis - (90 * 24 * 60 * 60 * 1000)
RETURN role.name, role.arn, role.last_used
ORDER BY role.last_used

Find Lambda functions with overprivileged roles

MATCH (func:AWSLambda)-[:STS_ASSUME_ROLE_ALLOWS]->(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)
WHERE policy.name = 'AdministratorAccess'
RETURN func.name, func.arn, role.name, policy.name

Network path analysis

MATCH (vpc:AWSVpc)-[:RESOURCE]->(subnet:EC2Subnet)-[:MEMBER_OF_SUBNET]->(instance:EC2Instance)
WHERE instance.publicipaddress IS NOT NULL
RETURN vpc.id, subnet.subnetid, subnet.cidr_block, instance.instanceid,
       instance.publicipaddress, instance.state

Scheduling Regular Syncs

Cron-based sync

# Add to crontab - sync every 6 hours
0 */6 * * * /usr/local/bin/cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  >> /var/log/cartography/sync.log 2>&1

Docker Compose deployment

version: '3.8'
services:
  neo4j:
    image: neo4j:5-community
    ports:
      - "7474:7474"
      - "7687:7687"
    environment:
      NEO4J_AUTH: neo4j/securepwd123
      NEO4J_PLUGINS: '["apoc"]'
      NEO4J_dbms_memory_heap_max__size: 4G
    volumes:
      - neo4j_data:/data

  cartography:
    image: ghcr.io/cartography-cncf/cartography:latest
    depends_on:
      - neo4j
    environment:
      NEO4J_PASSWORD: securepwd123
      AWS_DEFAULT_REGION: us-east-1
    command: >
      --neo4j-uri bolt://neo4j:7687
      --neo4j-user neo4j
      --neo4j-password-env-var NEO4J_PASSWORD

volumes:
  neo4j_data:

Data Model Overview

Key Node Types

• AWSAccount, GCPProject, AzureSubscription
• EC2Instance, S3Bucket, RDSInstance, AWSLambda
• AWSUser, AWSRole, AWSGroup, AWSPolicy
• EC2SecurityGroup, EC2Subnet, AWSVpc
• GCPInstance, GCSBucket, GCPRole

Key Relationship Types

• RESOURCE: Account owns resource
• POLICY: Principal has policy attached
• STS_ASSUME_ROLE_ALLOWS: Principal can assume role
• MEMBER_OF_EC2_SECURITY_GROUP: Instance belongs to SG
• TRUSTS_AWS_PRINCIPAL: Cross-account trust

References

• Cartography GitHub: https://github.com/cartography-cncf/cartography
• Cartography Documentation: https://cartography.dev
• CNCF Sandbox Project
• Neo4j Cypher Query Language Reference