Cloud Security Architecture Map

How the Architecture Map draws your AWS, Google Cloud and Azure estate from the inventory, with exposure, identity, data and findings on top, and how to read, filter and save it.

The Architecture Map of Cloud Security draws your estate from the inventory, with exposure, identity, data and findings on top. This page covers how it is drawn and how to work with it.

How the estate is drawn

The map draws your estate the way you would draw it on a whiteboard: each account, its regions, the VPCs inside them and the public and private subnets of each VPC, with every service placed where it runs and the identities and global services in their own lanes. A Google Cloud project is drawn the same way: its VPC networks, which span every region, sit at the project level with their subnetworks under them, and each region holds the services that run there. An Azure subscription is drawn with its virtual networks and their subnets, each machine placed in the subnet of its network interface.

The lines say how things connect, in plain words: a record resolves to a distribution, a distribution routes to its origin, a load balancer sends traffic to its targets, a role is attached to an instance, a role can read a bucket, a key encrypts a store, a web ACL or a security group protects a resource. The internet is a node of its own in front of every entry point found reachable, and a line turns red when the exposure is confirmed from outside or the link belongs to a risky path.

Badges

Each resource carries a badge with its open findings: red for critical, orange for high, amber for medium, green when the controls that apply to it passed, grey when no control evaluates it yet. A box carries the worst risk of what it holds, so a finding on a route table still shows on its VPC. Findings do not become nodes: they stay on the resource they concern.

Modes

The mode changes what the map emphasizes. Topology shows how the services connect. Security adds the security groups and puts the risk band on every border. Exposure keeps only the way in from the internet, laid out from left to right, so you see where traffic enters and which workloads receive it. The Critical paths switch draws the active attack paths over the map, and each path links to the Attack Paths page that explains it and the smallest fix that breaks it.

Large accounts

Regions that hold nothing but default networking fold into one node, and many resources of one type become a single group such as "S3 buckets (112)" that keeps the riskiest ones outside. Double click a group or a closed box to open it and an open box to close it; double click the public or private subnets to see one box per subnet, grouped by availability zone. The search finds a resource by name, identifier, ARN, IP address or tag and opens whatever holds it.

Resource details

Click a resource to read its details without leaving the map: where it runs, whether it is public and reachable, its encryption, its role, its security groups, its data class, its findings and compliance failures, what reaches it and what it reaches, the attack paths through it, the exposure evidence and its recent changes, each with a link to the page that has the full story. The same panel highlights its relations, its blast radius or the path from the internet to it.

Presets

The presets light up what answers one question: internet exposure, identity trust and privilege, sensitive data paths, the critical attack surface, public resources, cross-account trust, the resources changed in the last 24 hours and critical findings only.

Saved views and export

Drag nodes to arrange the map and save the view with its scope, its mode, the boxes you opened and the positions you chose; a saved view is shared with your organization. Export PNG / SVG downloads the drawing on screen. Reading the map needs the Cloud Security view permission; exporting needs the export permission.