I built the blast-radius tool I kept arguing for
· re: blast-radius: map everything a set of AWS credentials can reach (GitHub)
I keep saying you can’t contain a blast radius you have not measured. So this weekend I built a small thing that measures it.
blast-radius is an open-source script (Apache 2.0, a personal project, not a work product) that takes a set of AWS credentials and draws you a picture of everything they can actually reach: the services, the resources, the permissions they carry, on one page. It reads what the keys are granted, asks AWS’s own policy simulator what they are allowed to do, then does a read-only probe. One dependency, runs on Mac, Linux and Windows.
Why it exists: most teams have never actually looked at what a single leaked key would open. They have a policy document, not a map. The two are not the same thing, and the gap between them is where the bad weekend lives.
My read: the part I care about is not the graph, it is the honesty. Point it at a locked-down key and it tells you “I could not map this, which is a good sign”, instead of pretending that zero access found means safe.
Have a look, break it, tell me what it gets wrong: github.com/rob-linton/blast-radius