Cartography

Cartography currently does not ingest many of the AWS resource types used in popular CloudGoat attack/detection scenarios. This mentorship project will extend Cartography’s AWS plugin and schema to cover these missing resources, enabling security practitioners to visualize and query full CloudGoat labs end‑to‑end. The mentee will: i. Audit the AWS resource types used across selected CloudGoat scenarios. ii. Update Cartography’s schema to include each resource, with appropriate labels and key properties. iii. Implement ingestion functions in the AWS plugin, including relationship discovery (e.g., linking log groups to CloudWatch alarms). iv. Add Cypher sample queries and Python examples to the docs demonstrating how to explore one's infrastructure. Expected Outcome: 1) Support for the full list of AWS resources used in CloudGoat (e.g. SSM parameters, CodeBuild projects, CloudWatch metrics/alarms, SNS topics/subscriptions, ECS/EFS resources, Glue jobs, API Gateway, Cognito, Secrets Manager, etc.). a. Full list in the linked issue 2) Automated test coverage for each new resource type. 3) Updated documentation and example notebooks showing end‑to‑end CloudGoat use cases with Cartography.

Cartography (https://github.com/cartography-cncf/cartography) makes maps of the cloud so that security and devops teams can find and fix problems. Think about it like the Maurauder's Map (https://simple.wikipedia.org/wiki/Marauder%27s_Map) from Harry Potter. Cartography has very good AWS coverage, but lacks support for many Azure and GCP resources. With your help, we can fix this! Companies around the world use Cartography to better understand their infra, and you can be a part of this. Most of these modules should be conducive to coding with agents (we have a well-documented AGENTS.md! (https://github.com/cartography-cncf/cartography/blob/master/AGENTS.md), so if you enjoy writing in Python, want to learn about information security/devops, and moving fast, this is the project for you. Expected Outcome: Design and implement graph schemas for missing Azure and AWS objects in Cartography

Want to be a cloud hacker? In the cloud, answering the question "who has access to what" is surprisingly complex: we need to know what identities exist, what permission policies and controls apply to them, what resources (storage, compute, networking) exist, what permissions apply to those, and we need to tie those together. Cartography (https://github.com/cartography-cncf/cartography) is an ambitious open source project that aims to do just that. In this project, our goal is to model and map cloud IAM relationships in GCP and Azure so users can answer “who can access what resources” across multi-cloud environments. We previously did this in AWS as seen in “IAM: Whatever You Say I Am”(https://eng.lyft.com/iam-whatever-you-say-iam-febce59d1e3b), and we would love to complete our coverage of this across the major cloud providers. Expected Outcome: 1. Design and implement support for evaluating permission objects in GCP and Azure to draw paths such as (:GCPUser)- [:CAN_READ]->(:GCPBucket) or (:AzureServicePrincipal)- [:CAN_READ]->(:StorageAccount). 2. Bonus: opportunity to author or co-author a blog post or video demo