performing-cloud-asset-inventory-with-cartography

name	performing-cloud-asset-inventory-with-cartography
description	Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, mapping relationships such as IAM permission chains, network paths, and cross-account trust. Use when building a cloud asset inventory, querying the graph to identify attack paths, or generating security reports across multi-cloud infrastructure.
domain	cybersecurity
subdomain	cloud-security
tags	["cartography","neo4j","cloud-security","asset-inventory","attack-path","graph-database","cncf","lyft"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580"]

Performing Cloud Asset Inventory with Cartography

Overview

Cartography is a CNCF sandbox project (originally created at Lyft) that consolidates infrastructure assets and their relationships into a Neo4j graph database. It queries cloud APIs to discover resources, maps relationships between them, and enables security teams to identify attack paths, generate asset reports, and find areas for security improvement. The graph model reveals hidden connections such as IAM permission chains, network paths, and cross-account trust relationships.

When to Use

• When conducting security assessments that involve performing cloud asset inventory with cartography
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Python 3.8+
• Neo4j 4.x or 5.x database
• Cloud provider credentials (AWS, GCP, Azure)
• Docker (optional, for Neo4j deployment)
• Minimum 4GB RAM for Neo4j, more for large environments

Installation

# Install Cartography
pip install cartography

# Verify installation
cartography --help

Deploy Neo4j with Docker

docker run -d \
  --name neo4j \
  -p 7474:7474 -p 7687:7687 \
  -e NEO4J_AUTH=neo4j/changethispassword \
  -e NEO4J_PLUGINS='["apoc"]' \
  -v neo4j_data:/data \
  neo4j:5-community

Running Cartography

Basic AWS Sync

# Sync AWS account data to Neo4j
cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD

Sync specific AWS modules

cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  --aws-sync-all-profiles

GCP Sync

cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  --gcp-requested-syncs compute iam storage

Security-Focused Cypher Queries

Find all S3 buckets with public access

MATCH (b:S3Bucket)
WHERE b.anonymous_access = true
   OR b.anonymous_actions IS NOT NULL
RETURN b.name, b.anonymous_actions, b.region, b.arn
ORDER BY b.name