Skip to content
Opsec

Infrastructure

The infrastructure agent evaluates what an identity can really do — across policies, trust relationships and network paths — instead of flagging every rule in isolation.

Request accessHow validation works

Coverage

  • AWS
  • GCP
  • Azure
  • Terraform
  • Kubernetes

What it finds

Vulnerability classes, confirmed.

  • Confirmed class

    Public data exposure

    Buckets, snapshots and databases reachable from the internet through any combination of settings.

  • Confirmed class

    Privilege escalation

    Role chains, pass-role abuse and policy wildcards that lead to administrative access.

  • Confirmed class

    Lateral movement

    Network paths and trust relationships connecting a compromised workload to sensitive systems.

  • Confirmed class

    Kubernetes misconfiguration

    Privileged pods, service account token exposure and permissive RBAC bindings.

  • Confirmed class

    Secrets in configuration

    Credentials in state files, environment variables and container images.

  • Confirmed class

    Drift from code

    Changes made in the console that undo controls defined in infrastructure-as-code.

Validation

Nothing is reported until it is proven.

  1. Step 1 / 3

    Model the account

    Opsec builds a graph of identities, resources and network reachability from read-only APIs and IaC.

  2. Step 2 / 3

    Simulate the attacker

    The agent evaluates real policy decisions for each step of a candidate path.

  3. Step 3 / 3

    Show the path

    Findings include every hop, the permission used at each and the data reachable at the end.

Example finding

What lands in your queue.

Each finding carries the exploit path the validator walked and the repair it verified.

TSR-2318infra-prodterraform/storage.tf
High

Public read ACL on export bucket

CWE-284 · Infrastructure agent · Exploitability 8.2

Exploit path

The exports bucket grants public-read. Customer CSV exports can be listed and downloaded without credentials.

Why the fix works

Sets the ACL to private and adds a public access block so a future change cannot silently re-expose the bucket.

Generated repair
resource "aws_s3_bucket_acl" "exports" {
  bucket = aws_s3_bucket.exports.id
  acl    = "public-read"
  acl    = "private"
}
resource "aws_s3_bucket_public_access_block" "exports" {
  block_public_acls = true
}
  • terraform plan: 0 public paths
  • Anonymous listing denied
  • Signed download URLs unaffected

Other solutions

See what's exploitable in your environment.

Opsec is available to a limited number of security teams. Request access and we'll scope a private deployment with you.

Request accessBook a briefing