skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-cloud-asset-inventory-with-cartography

Build a Neo4j security graph of cloud assets, IAM permissions, and attack paths using Cartography.

954|172|Updated Mar 13, 2026
Search Tags:#AWS#cloud security#neo4j#cypher#cartography#attack path#asset inventory
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-cloud-asset-inventory-with-cartography
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-cloud-asset-inventory-with-cartography
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/performing-cloud-asset-inventory-with-cartography
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-cloud-asset-inventory-with-cartography

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires cartography.

What problem does it solve?

Cloud environments across AWS, GCP, and Azure accumulate resources and IAM relationships that are hard to inventory and audit, making it difficult to spot public exposure, overprivileged identities, and attack paths.

Core Features & Use Cases

  • Multi-Cloud Asset Sync: Ingest AWS, GCP, and Azure resources into a Neo4j graph database with scheduled syncs via cron or Docker Compose.
  • Security Cypher Queries: Run ready-made queries to find public S3 buckets, admin IAM users, internet-exposed EC2 instances, cross-account trusts, and unused roles.
  • Attack Path Analysis: Trace multi-hop paths from public instances to sensitive data stores using graph relationships.
  • Use Case: A security engineer syncs all AWS accounts into Neo4j, then runs Cypher queries to enumerate publicly accessible S3 buckets and IAM roles with AdministratorAccess before an audit.

Quick Start

Ask the AI to install Cartography, deploy Neo4j with Docker, sync your AWS account, and run a Cypher query listing all S3 buckets with anonymous access.

Frequently Asked Questions about performing-cloud-asset-inventory-with-cartography

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform cloud asset inventory with Cartography?▼

Install Cartography with pip, deploy a Neo4j database, then run the cartography CLI with your Neo4j URI and cloud credentials. It syncs AWS, GCP, or Azure resources into a graph you can query with Cypher.

How to find public S3 buckets using Neo4j and Cartography?▼

After syncing AWS data, run a Cypher query matching S3Bucket nodes where anonymous_access is true or anonymous_actions is set. Confirm each result with aws s3api get-public-access-block, since account-level Block Public Access is not modeled.

Does Cartography support GCP and Azure in addition to AWS?▼

Yes, Cartography supports AWS, GCP, and Azure. For GCP, pass the --gcp-requested-syncs flag with modules like compute, iam, and storage; Azure subscriptions are also represented as graph nodes.

Why does my Cartography graph show stale or missing resources?▼

Cartography only ingests configured modules and accounts, and silently skips resources it lacks permission to read. Failed cleanups can also leave stale nodes, so filter results by the lastupdated timestamp and reconcile node counts against the cloud APIs.

What are the limitations of Cartography attack path queries?▼

Variable-length Cypher matches like *1..5 miss longer paths, and Cartography does not model every relationship such as resource-based S3/KMS policies, SCPs, or session policies. Corroborate IAM escalation paths with tools like PMapper.

Related Skills

Explore More Software Engineering Skills→
NOMARJNOMARJ

terraform-module-library

Generate reusable Terraform modules for AWS, Azure, and GCP infrastructure.

Official
Advanced
yoanbernabeuyoanbernabeu
62

supabase-audit-buckets-read

Lists and validates Supabase storage bucket access controls for public exposure.

Community
Intermediate
woohyun212woohyun212
21

cloud-pentest

Assess AWS, Azure, and GCP security posture with ScoutSuite and Prowler audits.

Community
Advanced
ArdurAIArdurAI
1

god-security-cloud

Audit AWS, Azure, and GCP configurations for security misconfigurations.

Official
Advanced