You can't contain a blast radius you haven't measured

By Rob Linton ·2026-08-25

Most security teams can tell you what their IAM policies say. Very few can tell you what a single leaked key would actually open. Those are different questions, and the gap between them is where the bad weekend lives.

So I built a small tool to close it. It is called blast-radius, it is open source, and it does one thing: point it at a set of AWS credentials and it draws you a picture of everything they can reach.

Example output. The account, principal and resource names are placeholders; the shape and counts are what the tool produces.

Why measure a blast radius at all?

You cannot contain a blast radius you have never measured. The policy document is the intent; what a key can actually reach is the reality; the two drift, quietly, for years. This is the same question I have been chasing since the 1990s, who is allowed to read this, pointed at a set of credentials instead of a person.

The reason it matters got a very public airing this month. In a controlled test, AI models found a zero-day, escaped their sandbox, used stolen credentials, and chained more than 17,000 automated actions over a single weekend before anyone knew a frontier model was behind it. Detection lost that race. Even the vendors said so: Bill Robbins, CEO of Menlo Security, wrote that “if a vendor claims its product would have cleanly stopped this specific attack, that claim deserves scrutiny.” The credible answer is containment, and containment starts with knowing what a credential can reach before it is used against you.

What does it actually show you?

blast-radius reads what a set of AWS credentials are granted, then asks AWS’s own policy simulator what they are actually allowed to do. It probes only the services that came back allowed, read-only, and puts the answer on one page: the services, each sized by what it holds; a sortable table of what was found; the permissions the key carries. On a real account of mine it mapped 14 reachable services and 106 resources in 22 read-only API calls.

A policy document tells you what should be reachable. This tells you what is.

What happens when the key is dangerous?

Point it at an administrator key and it says so, loudly, before it draws anything else.

An Allow on Action:* / Resource:* means the blast radius is the entire account, and the map is only what happened to be running at the time. That is the reach a lot of CI-deploy keys quietly carry, sitting in a pipeline config, one leak away from being the whole story.

What does it do when it cannot see anything?

The graph is what people will screenshot. What matters more to me is what the tool does when it cannot see anything. Point blast-radius at a locked-down key that cannot even enumerate its own permissions and it tells you the blast radius “could not be mapped from outside”, and calls that “a good sign of a tightly-scoped credential”, instead of pretending that zero access found means safe. I know because I ran it against exactly such a key of my own, a tightly-scoped one, and it refused to flatter me. A security tool that reports “clean” when it was actually blindfolded is worse than no tool, because you will believe it.

The honest caveat, so nobody is caught out: blast-radius maps reach, it does not prove every possible access path, and the account-ID check that stops a stranger pointing it at your account with a stray key is a deterrent, not a cryptographic wall (the script is open source and editable). It is an audit aid, not an assessment, and you should only ever run it on accounts you are authorised to audit. Read the code before you trust it, the same way you should treat any tool that touches your credentials.

Rob Linton built and runs blast-radius (yes, me, written in the third person so the search engines file it under the right name). It is one script, one dependency (the AWS CLI), and it runs on Mac, Linux and Windows. Have a look, break it, and tell me what it gets wrong: the blast-radius repo on GitHub. And if you have never actually looked at what one of your keys would open, that is exactly the reason it exists.