7/25/2026 at 8:09:06 PM
by 0hardik1
7/26/2026 at 12:18:56 AM
If you use AWS Config with an organization wide aggregator, which Control Tower sets up by default these days, have your agent use it to find resources and related resources. You can build most of the graph from that alone without traversing accounts.by thedougd
7/25/2026 at 11:22:48 PM
What’s the value of having a ton of silo’d accounts, especially for the use case demonstrated by the readme where there are multiple staging and production accounts?by chaos_emergent
7/26/2026 at 12:16:21 AM
Blast radius. One example… What happens when you give an identity s3:* on resource: *? It can read/modify every bucket in the account that doesn’t have a resource policy with an explicit deny.by thedougd
7/25/2026 at 11:34:07 PM
This is not super uncommon, especially when selling to enterprises who demand complete data isolation.by casper14
7/25/2026 at 11:55:07 PM
[dead]by 0hardik1