Attack Paths

​

Prerequisites

• An AWS provider is configured with valid credentials in Prowler Cloud. For setup instructions, see Getting Started with AWS.
• At least one scan has completed on the configured AWS provider and produced graph data. Attack Paths scans run automatically alongside regular security scans, no separate configuration is required.

​

How Attack Paths Scans Work

​

Accessing Attack Paths

• Select a scan with graph data.
• Choose a built-in query or a custom openCypher query.
• Add parameters when the selected query requires them.
• Execute the query and explore the resulting graph.

​

Selecting a Scan

• Select: A radio button used to choose a scan. The radio button is disabled when graph data is not available.
• Provider: The AWS provider alias and account identifier.
• Last Scan Date: When the scan completed.
• Status: Current state of the scan, such as Completed, Executing, Scheduled, or Failed.
• Graph: Whether Attack Paths graph data is available for the scan.
• Duration: Total scan time.

​

Choosing a Query

• Query name: A descriptive title, such as Internet-Exposed EC2 with Sensitive S3 Access.
• Short description: A brief summary of what the query detects.

​

Configuring Query Parameters

• Required fields are marked with an asterisk (*) and must be filled before executing.
• Optional fields refine the query results but are not mandatory.
• Queries without parameters show no parameter form.

​

Writing Custom openCypher Queries

​

Constraints and Safety Limits

• Read-only: Only read operations are allowed. Statements that mutate the graph (CREATE, MERGE, SET, DELETE, REMOVE, DROP, LOAD CSV, CALL { ... } writes, etc.) are rejected before execution.
• Length limit: Each query is capped at 10,000 characters.
• Scoped to the selected scan: Results are automatically scoped to the provider and scan selected in the scan table. There is no need to filter by tenant or scan identifier in the query body.

​

Example Queries

MATCH (i:EC2Instance)--(sg:EC2SecurityGroup)--(rule:IpPermissionInbound)
WHERE i.exposed_internet = true
RETURN i.instanceid AS instance, sg.name AS security_group,
       rule.fromport AS from_port, rule.toport AS to_port
LIMIT 25

MATCH (i:EC2Instance)-[:STS_ASSUMEROLE_ALLOW]->(r:AWSRole)
WHERE i.exposed_internet = true
RETURN i.instanceid AS instance, r.name AS role_name, r.arn AS role_arn
LIMIT 25

MATCH (principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {effect: 'Allow'})
MATCH (stmt)-[:HAS_ACTION]->(a:AWSPolicyStatementActionItem)
WHERE a.value = '*'
RETURN DISTINCT principal.arn AS principal, policy.arn AS policy
LIMIT 25

MATCH (i:EC2Instance)-[:HAS_FINDING]->(f:ProwlerFinding)
WHERE i.exposed_internet = true AND f.status = 'FAIL'
  AND f.severity IN ['critical', 'high']
RETURN i.instanceid AS instance, f.check_id AS check,
       f.severity AS severity, f.status AS status
LIMIT 50

MATCH (r:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(p:AWSPrincipal)
WHERE p.arn ENDS WITH '.amazonaws.com'
RETURN r.name AS role_name, r.arn AS role_arn, p.arn AS trusted_service
LIMIT 25

​

Graph Schema and Advanced Patterns

​

Executing a Query

• No matching patterns found: The scanned environment does not contain the pattern the query targets.
• Not enough permissions: The scan credentials may not have captured all the data the query needs.
• Server unavailable: The graph service may be temporarily unavailable.

​

Exploring the Graph

​

Node Types

• Provider root nodes: Represent the AWS account or provider root for the selected scan.
• Resource nodes: Represent cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets.
• Internet nodes: Represent exposure from the public internet.
• Finding nodes: Represent Prowler findings linked to resources. Finding colors indicate risk level, such as critical, high, medium, or low.

​

Edge Types

• Normal edges: Direct relationships between graph nodes, such as role-to-policy or resource-to-security-group relationships.
• Finding edges: Dashed relationships between resources and their associated findings.
• Highlighted paths: Green edges that show the active path when you hover a node or focus a finding.

​

Interacting with the Graph

• Click a finding to focus its connected path.
• Click a resource with findings to show or hide its related findings.
• Hover a node to highlight its connected path.

​

Showing Related Findings

​

Focusing a Finding Path

• The graph shows Back to Full View.
• The status banner shows the selected finding.
• The graph keeps only the connected path in view.
• The finding detail drawer opens.

​

Graph Controls

• Zoom in / Zoom out: Adjust the zoom level
• Fit graph to view: Reset the view to fit the visible graph
• Export graph: Download the current graph as a PNG file
• Fullscreen: Open the graph in a full-size modal

​

Viewing Finding Details

• The finding title, status, and severity.
• The affected resource summary.
• Overview, remediation, evidence, related findings, scans, and events tabs when data is available.
• A Lighthouse AI action when the account has access to Lighthouse AI.

​

Fullscreen Mode

• The graph in a full-size modal.
• The same zoom, fit, and export controls.
• The same node expansion, finding focus, hover highlight, and minimap interactions available in the standard view.

​

Available Queries

• Custom openCypher query: Write and run a read-only graph query.
• Exposure queries: Find internet-exposed EC2 instances, load balancers, open security groups, and resources by public IP.
• Inventory queries: List resources such as RDS instances.
• Misconfiguration queries: Find unencrypted RDS instances, public S3 buckets, and wildcard IAM statements.
• Privilege escalation queries: Detect IAM and AWS service paths based on known attack techniques, including queries based on pathfinding.cloud research by Datadog.

​

Using Attack Paths with the MCP Server and Lighthouse AI

• prowler_list_attack_paths_scans - List and filter Attack Paths scans.
• prowler_list_attack_paths_queries - Discover available queries for a completed scan.
• prowler_run_attack_paths_query - Execute a query and retrieve graph results with nodes and relationships.
• prowler_get_attack_paths_cartography_schema - Retrieve the Cartography graph schema for custom openCypher queries.

​

Example Questions

• “Find EC2 instances exposed to the internet with access to sensitive S3 buckets”
• “Are there any IAM roles that can escalate their own privileges?”
• “Show me all internet-facing resources with open security groups”
• “Which principals can create Lambda functions with privileged roles?”
• “List all RDS instances with storage encryption disabled”
• “Find S3 buckets that allow anonymous access”
• “Are there any CloudFormation stacks that could be hijacked for privilege escalation?”
• “Show me all roles that can be assumed for lateral movement”

• Asking an AI assistant to identify privilege escalation paths in a specific AWS account
• Automating attack path analysis across multiple scans
• Combining attack path data with findings and compliance information for comprehensive security reports