Uses Cartography to inventory cloud assets, map relationships, and build Neo4j graphs of infrastructure, IAM permissions, and attack paths in AWS, GCP, Azure for security analysis.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
Cartography 是一个 CNCF 沙箱项目（最初由 Lyft 创建），将基础设施资产及其关系整合到 Neo4j 图数据库中。它通过查询云 API 发现资源，映射资源间关系，使安全团队能够识别攻击路径、生成资产报告并找到安全改进点。图模型揭示了 IAM 权限链、网络路径和跨账户信任关系等隐藏连接。
Runs Cartography to inventory cloud assets and map relationships across AWS, GCP, Azure into Neo4j graph for IAM analysis and attack path discovery.
Runs Cartography to inventory AWS, GCP, Azure assets and map relationships/IAM/attack paths in Neo4j for security audits and Cypher queries.
Inventories cloud resources on AWS, GCP, Cloudflare, Fly.io via CLI; scans IaC configs; maps connections and flags risks for infra reconnaissance.
Share bugs, ideas, or general feedback.
Cartography 是一个 CNCF 沙箱项目（最初由 Lyft 创建），将基础设施资产及其关系整合到 Neo4j 图数据库中。它通过查询云 API 发现资源，映射资源间关系，使安全团队能够识别攻击路径、生成资产报告并找到安全改进点。图模型揭示了 IAM 权限链、网络路径和跨账户信任关系等隐藏连接。
# 安装 Cartography
pip install cartography
# 验证安装
cartography --help
docker run -d \
--name neo4j \
-p 7474:7474 -p 7687:7687 \
-e NEO4J_AUTH=neo4j/changethispassword \
-e NEO4J_PLUGINS='["apoc"]' \
-v neo4j_data:/data \
neo4j:5-community
# 同步 AWS 账户数据到 Neo4j
cartography \
--neo4j-uri bolt://localhost:7687 \
--neo4j-user neo4j \
--neo4j-password-env-var NEO4J_PASSWORD
cartography \
--neo4j-uri bolt://localhost:7687 \
--neo4j-user neo4j \
--neo4j-password-env-var NEO4J_PASSWORD \
--aws-sync-all-profiles
cartography \
--neo4j-uri bolt://localhost:7687 \
--neo4j-user neo4j \
--neo4j-password-env-var NEO4J_PASSWORD \
--gcp-requested-syncs compute iam storage
MATCH (b:S3Bucket)
WHERE b.anonymous_access = true
OR b.anonymous_actions IS NOT NULL
RETURN b.name, b.anonymous_actions, b.region, b.arn
ORDER BY b.name
MATCH (user:AWSUser)-[:POLICY]->(policy:AWSPolicy)
WHERE policy.name = 'AdministratorAccess'
OR policy.arn CONTAINS 'AdministratorAccess'
RETURN user.name, user.arn, policy.name, user.password_last_used
MATCH (instance:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
-[:MEMBER_OF_EC2_SECURITY_GROUP_RULE]->(rule:IpRule)
WHERE rule.fromport <= 22 AND rule.toport >= 22
AND rule.protocol IN ['tcp', '-1']
AND '0.0.0.0/0' IN rule.ipranges
RETURN instance.instanceid, instance.publicipaddress, sg.groupid, sg.name
MATCH (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(principal:AWSPrincipal)
WHERE principal.arn CONTAINS ':root'
AND NOT principal.arn CONTAINS role.accountid
RETURN role.arn, role.name, principal.arn AS trusted_account
ORDER BY role.name
MATCH path = (instance:EC2Instance)-[:STS_ASSUME_ROLE_ALLOWS|MEMBER_OF_EC2_SECURITY_GROUP|
POLICY|INSTANCE_PROFILE*1..5]->(bucket:S3Bucket)
WHERE instance.publicipaddress IS NOT NULL
AND bucket.name CONTAINS 'sensitive'
RETURN path
LIMIT 25
MATCH (role:AWSRole)
WHERE role.last_used IS NULL
OR role.last_used < datetime().epochMillis - (90 * 24 * 60 * 60 * 1000)
RETURN role.name, role.arn, role.last_used
ORDER BY role.last_used
MATCH (func:AWSLambda)-[:STS_ASSUME_ROLE_ALLOWS]->(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)
WHERE policy.name = 'AdministratorAccess'
RETURN func.name, func.arn, role.name, policy.name
MATCH (vpc:AWSVpc)-[:RESOURCE]->(subnet:EC2Subnet)-[:MEMBER_OF_SUBNET]->(instance:EC2Instance)
WHERE instance.publicipaddress IS NOT NULL
RETURN vpc.id, subnet.subnetid, subnet.cidr_block, instance.instanceid,
instance.publicipaddress, instance.state
# 添加到 crontab - 每 6 小时同步一次
0 */6 * * * /usr/local/bin/cartography \
--neo4j-uri bolt://localhost:7687 \
--neo4j-user neo4j \
--neo4j-password-env-var NEO4J_PASSWORD \
>> /var/log/cartography/sync.log 2>&1
version: '3.8'
services:
neo4j:
image: neo4j:5-community
ports:
- "7474:7474"
- "7687:7687"
environment:
NEO4J_AUTH: neo4j/securepwd123
NEO4J_PLUGINS: '["apoc"]'
NEO4J_dbms_memory_heap_max__size: 4G
volumes:
- neo4j_data:/data
cartography:
image: ghcr.io/cartography-cncf/cartography:latest
depends_on:
- neo4j
environment:
NEO4J_PASSWORD: securepwd123
AWS_DEFAULT_REGION: us-east-1
command: >
--neo4j-uri bolt://neo4j:7687
--neo4j-user neo4j
--neo4j-password-env-var NEO4J_PASSWORD
volumes:
neo4j_data:
AWSAccount、GCPProject、AzureSubscriptionEC2Instance、S3Bucket、RDSInstance、AWSLambdaAWSUser、AWSRole、AWSGroup、AWSPolicyEC2SecurityGroup、EC2Subnet、AWSVpcGCPInstance、GCSBucket、GCPRoleRESOURCE：账户拥有资源POLICY：主体附加了策略STS_ASSUME_ROLE_ALLOWS：主体可以担任角色MEMBER_OF_EC2_SECURITY_GROUP：实例属于安全组TRUSTS_AWS_PRINCIPAL：跨账户信任