What it does. Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-cloud-asset-inventory-with-cartography/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-asset-inventory-with-cartography, or copy the skill folder into ~/.claude/skills/performing-cloud-asset-inventory-with-cartography/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md

SKILL.md (verbatim)

name: performing-cloud-asset-inventory-with-cartography
description: Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database,
  mapping relationships such as IAM permission chains, network paths, and cross-account trust.
  Use when building a cloud asset inventory, querying the graph to identify attack paths, or
  generating security reports across multi-cloud infrastructure.
domain: cybersecurity
subdomain: cloud-security
tags:
- cartography
- neo4j
- cloud-security
- asset-inventory
- attack-path
- graph-database
- cncf
- lyft
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1078.004
- T1530
- T1537
- T1580

Performing Cloud Asset Inventory with Cartography

Overview

Cartography is a CNCF sandbox project (originally created at Lyft) that consolidates infrastructure assets and their relationships into a Neo4j graph database. It queries cloud APIs to discover resources, maps relationships between them, and enables security teams to identify attack paths, generate asset reports, and find areas for security improvement. The graph model reveals hidden connections such as IAM permission chains, network paths, and cross-account trust relationships.

When to Use

• When conducting security assessments that involve performing cloud asset inventory with cartography
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Python 3.8+
• Neo4j 4.x or 5.x database
• Cloud provider credentials (AWS, GCP, Azure)
• Docker (optional, for Neo4j deployment)
• Minimum 4GB RAM for Neo4j, more for large environments

Installation

# Install Cartography
pip install cartography

# Verify installation
cartography --help

Deploy Neo4j with Docker

docker run -d \
  --name neo4j \
  -p 7474:7474 -p 7687:7687 \
  -e NEO4J_AUTH=neo4j/changethispassword \
  -e NEO4J_PLUGINS='["apoc"]' \
  -v neo4j_data:/data \
  neo4j:5-community

Running Cartography

Basic AWS Sync

# Sync AWS account data to Neo4j
cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD

Sync specific AWS modules

cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  --aws-sync-all-profiles

GCP Sync

cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  --gcp-requested-syncs compute iam storage

Security-Focused Cypher Queries

Find all S3 buckets with public access

MATCH (b:S3Bucket)
WHERE b.anonymous_access = true
   OR b.anonymous_actions IS NOT NULL
RETURN b.name, b.anonymous_actions, b.region, b.arn
ORDER BY b.name

Identify IAM users with admin policies

MATCH (user:AWSUser)-[:POLICY]->(policy:AWSPolicy)
WHERE policy.name = 'AdministratorAccess'
   OR policy.arn CONTAINS 'AdministratorAccess'
RETURN user.name, user.arn, policy.name, user.password_last_used

Find EC2 instances exposed to internet

MATCH (instance:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
      -[:MEMBER_OF_EC2_SECURITY_GROUP_RULE]->(rule:IpRule)
WHERE rule.fromport <= 22 AND rule.toport >= 22
  AND rule.protocol IN ['tcp', '-1']
  AND '0.0.0.0/0' IN rule.ipranges
RETURN instance.instanceid, instance.publicipaddress, sg.groupid, sg.name

Discover cross-account trust relationships

MATCH (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(principal:AWSPrincipal)
WHERE principal.arn CONTAINS ':root'
  AND NOT principal.arn CONTAINS role.accountid
RETURN role.arn, role.name, principal.arn AS trusted_account
ORDER BY role.name

Find attack path from public EC2 to sensitive S3

MATCH path = (instance:EC2Instance)-[:STS_ASSUME_ROLE_ALLOWS|MEMBER_OF_EC2_SECURITY_GROUP|
  POLICY|INSTANCE_PROFILE*1..5]->(bucket:S3Bucket)
WHERE instance.publicipaddress IS NOT NULL
  AND bucket.name CONTAINS 'sensitive'
RETURN path
LIMIT 25

Identify unused IAM roles

MATCH (role:AWSRole)
WHERE role.last_used IS NULL
   OR role.last_used < datetime().epochMillis - (90 * 24 * 60 * 60 * 1000)
RETURN role.name, role.arn, role.last_used
ORDER BY role.last_used

Find Lambda functions with overprivileged roles

MATCH (func:AWSLambda)-[:STS_ASSUME_ROLE_ALLOWS]->(role:AWSRole)-[:POLICY]->(policy:AWSPolicy)
WHERE policy.name = 'AdministratorAccess'
RETURN func.name, func.arn, role.name, policy.name

Network path analysis

MATCH (vpc:AWSVpc)-[:RESOURCE]->(subnet:EC2Subnet)-[:MEMBER_OF_SUBNET]->(instance:EC2Instance)
WHERE instance.publicipaddress IS NOT NULL
RETURN vpc.id, subnet.subnetid, subnet.cidr_block, instance.instanceid,
       instance.publicipaddress, instance.state

Scheduling Regular Syncs

Cron-based sync

# Add to crontab - sync every 6 hours
0 */6 * * * /usr/local/bin/cartography \
  --neo4j-uri bolt://localhost:7687 \
  --neo4j-user neo4j \
  --neo4j-password-env-var NEO4J_PASSWORD \
  >> /var/log/cartography/sync.log 2>&1

Docker Compose deployment

version: '3.8'
services:
  neo4j:
    image: neo4j:5-community
    ports:
      - "7474:7474"
      - "7687:7687"
    environment:
      NEO4J_AUTH: neo4j/securepwd123
      NEO4J_PLUGINS: '["apoc"]'
      NEO4J_dbms_memory_heap_max__size: 4G
    volumes:
      - neo4j_data:/data

  cartography:
    image: ghcr.io/cartography-cncf/cartography:latest
    depends_on:
      - neo4j
    environment:
      NEO4J_PASSWORD: securepwd123
      AWS_DEFAULT_REGION: us-east-1
    command: >
      --neo4j-uri bolt://neo4j:7687
      --neo4j-user neo4j
      --neo4j-password-env-var NEO4J_PASSWORD

volumes:
  neo4j_data:

Data Model Overview

Key Node Types

• AWSAccount, GCPProject, AzureSubscription
• EC2Instance, S3Bucket, RDSInstance, AWSLambda
• AWSUser, AWSRole, AWSGroup, AWSPolicy
• EC2SecurityGroup, EC2Subnet, AWSVpc
• GCPInstance, GCSBucket, GCPRole

Key Relationship Types

• RESOURCE: Account owns resource
• POLICY: Principal has policy attached
• STS_ASSUME_ROLE_ALLOWS: Principal can assume role
• MEMBER_OF_EC2_SECURITY_GROUP: Instance belongs to SG
• TRUSTS_AWS_PRINCIPAL: Cross-account trust

References

• Cartography GitHub: https://github.com/cartography-cncf/cartography
• Cartography Documentation: https://cartography.dev
• CNCF Sandbox Project
• Neo4j Cypher Query Language Reference

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Cloud Asset Inventory Assessment Template

Environment

Field	Value
Cloud Providers	AWS / GCP / Azure
Accounts Scanned
Cartography Version
Neo4j Version
Sync Date

Asset Summary

Resource Type	Count	Critical Issues
EC2 Instances
S3 Buckets
IAM Users
IAM Roles
RDS Instances
Lambda Functions
Security Groups

Attack Paths Identified

Path	Source	Target	Severity	Remediation

references/api-reference.md (verbatim)

API Reference: Cartography Cloud Asset Inventory

Libraries Used

Library	Purpose
neo4j	Neo4j Python driver for graph database queries
subprocess	Execute Cartography CLI sync commands
boto3	AWS SDK for supplementary asset lookups
json	Parse Cartography output and Neo4j results

Installation

# Cartography
pip install cartography

# Neo4j Python driver
pip install neo4j

# Neo4j server (Docker)
docker run -d --name neo4j \
    -p 7474:7474 -p 7687:7687 \
    -e NEO4J_AUTH=neo4j/changeme \
    neo4j:5

Authentication

Neo4j Connection

from neo4j import GraphDatabase
import os

NEO4J_URI = os.environ.get("NEO4J_URI", "bolt://localhost:7687")
NEO4J_USER = os.environ.get("NEO4J_USER", "neo4j")
NEO4J_PASS = os.environ["NEO4J_PASS"]

driver = GraphDatabase.driver(NEO4J_URI, auth=(NEO4J_USER, NEO4J_PASS))

AWS Credentials for Sync

# Cartography uses standard AWS credential chain
export AWS_PROFILE=security-audit
# Or: AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY

CLI Reference

Sync AWS Assets to Neo4j

cartography --neo4j-uri bolt://localhost:7687 \
    --neo4j-user neo4j \
    --neo4j-password-env-var NEO4J_PASS \
    --aws-sync-all-profiles

Sync Specific AWS Services

cartography --neo4j-uri bolt://localhost:7687 \
    --neo4j-user neo4j \
    --neo4j-password-env-var NEO4J_PASS \
    --aws-requested-syncs ec2:instances,iam:users,s3

Key CLI Flags

Flag	Description
--neo4j-uri	Neo4j Bolt URI
--neo4j-user	Neo4j username
--neo4j-password-env-var	Env var containing Neo4j password
--aws-sync-all-profiles	Sync all configured AWS profiles
--aws-requested-syncs	Sync specific AWS services
--gcp-requested-syncs	Sync specific GCP services
--azure-sync-all-subscriptions	Sync all Azure subscriptions
--statsd-enabled	Enable StatsD metrics
--update-tag	Custom tag for this sync run

Cypher Queries for Security Analysis

Find Public S3 Buckets

def find_public_s3_buckets(driver):
    query = """
    MATCH (s:S3Bucket)
    WHERE s.anonymous_access = true
    RETURN s.name AS bucket, s.region AS region, s.arn AS arn
    """
    with driver.session() as session:
        return [dict(r) for r in session.run(query)]

Find IAM Users Without MFA

def find_users_without_mfa(driver):
    query = """
    MATCH (u:AWSUser)
    WHERE NOT (u)-[:HAS_MFA_DEVICE]->(:MFADevice)
      AND u.password_enabled = true
    RETURN u.name AS username, u.arn AS arn,
           u.password_last_used AS last_login
    """
    with driver.session() as session:
        return [dict(r) for r in session.run(query)]

Find EC2 Instances with Public IPs and Permissive Security Groups

def find_exposed_instances(driver):
    query = """
    MATCH (i:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
          -[:MEMBER_OF_IP_RULE]->(rule:IpRule)
    WHERE i.publicipaddress IS NOT NULL
      AND rule.cidr_ip = '0.0.0.0/0'
      AND rule.fromport <= 22
      AND rule.toport >= 22
    RETURN DISTINCT i.instanceid AS instance_id,
           i.publicipaddress AS public_ip,
           sg.name AS security_group
    """
    with driver.session() as session:
        return [dict(r) for r in session.run(query)]

Map Cross-Account IAM Trust Relationships

def find_cross_account_roles(driver):
    query = """
    MATCH (role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(principal:AWSPrincipal)
    WHERE principal.arn CONTAINS ':root'
      AND NOT principal.arn CONTAINS role.accountid
    RETURN role.arn AS role_arn,
           principal.arn AS trusted_principal,
           role.accountid AS role_account
    """
    with driver.session() as session:
        return [dict(r) for r in session.run(query)]

Find Unencrypted RDS Instances

def find_unencrypted_rds(driver):
    query = """
    MATCH (rds:RDSInstance)
    WHERE rds.storage_encrypted = false
    RETURN rds.db_instance_identifier AS db_name,
           rds.engine AS engine,
           rds.publicly_accessible AS public
    """
    with driver.session() as session:
        return [dict(r) for r in session.run(query)]

Cartography Node Types

Node Label	Represents
AWSAccount	AWS account
AWSUser	IAM user
AWSRole	IAM role
AWSPolicy	IAM policy
EC2Instance	EC2 instance
EC2SecurityGroup	Security group
S3Bucket	S3 bucket
RDSInstance	RDS database instance
LambdaFunction	Lambda function
EKSCluster	EKS Kubernetes cluster

Output Format

{
  "sync_time": "2025-01-15T10:30:00Z",
  "accounts_synced": 3,
  "nodes_created": 12450,
  "relationships_created": 34200,
  "findings": {
    "public_s3_buckets": 2,
    "users_without_mfa": 5,
    "exposed_instances": 3,
    "cross_account_trusts": 8,
    "unencrypted_databases": 4
  }
}

references/standards.md (verbatim)

Standards - Cloud Asset Inventory with Cartography

CIS Controls v8

• Control 1: Inventory and Control of Enterprise Assets
• Control 2: Inventory and Control of Software Assets
• Control 3: Data Protection
• Control 6: Access Control Management

NIST 800-53

• CM-8: System Component Inventory
• PM-5: System Inventory
• RA-2: Security Categorization

Cloud Security Alliance (CSA)

• CCM AIS-01: Application and Interface Security
• CCM DSP-01: Data Security and Privacy
• CCM IAM-01: Identity and Access Management

references/workflows.md (verbatim)

Workflows - Cloud Asset Inventory with Cartography

Asset Discovery Workflow

1. Deploy Neo4j → Setup graph database
2. Configure Credentials → AWS/GCP/Azure access
3. Initial Sync → Run Cartography to populate graph
4. Query Analysis → Execute security-focused Cypher queries
5. Attack Path Review → Identify and document attack paths
6. Schedule Syncs → Automate regular inventory updates
7. Alert Integration → Notify on new risky relationships

Security Assessment Workflow

1. Populate Graph → Run full Cartography sync
2. Public Exposure → Query for internet-facing resources
3. IAM Analysis → Identify overprivileged identities
4. Cross-Account → Map trust relationships
5. Network Paths → Analyze network reachability
6. Report → Generate findings for remediation

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.