Securitain Docs
On this page

Access Path Explorer

Find and visualize the reachable paths between two AWS identities in the IAM graph.

The IAM Relationship Graph shows how identities connect. The Access Path Explorer answers a more focused question: is there a path from a specific identity to another specific identity, and if so, what does that path look like? It is a targeted query within the graph rather than a full-graph visualization.

The question it answers

Is there a supported relationship path from identity A to identity B, and what are the shortest or most direct ways to get there?

This is useful when investigating whether a specific source — a developer, a workload role, a CI/CD identity — has a path toward a privileged or sensitive target, and what intermediate relationships that path passes through.

Where to find Access Path Explorer

IAM AnalyzerGraphRelationships

The Access Path Explorer panel opens from within the IAM Relationship Graph. Select the From and To identities and submit the query. Results appear as a focused path visualization rather than the full graph.

How a path query works

When you specify a source (From) and target (To) identity, the explorer searches the available graph for relationship paths between them.

From: dev-user
  ↓
[graph traversal]
  ↓
To: ProductionRole

Paths found:
  dev-user → Developers group → DeploymentPolicy → ProductionRole
  dev-user → DirectPolicy → ProductionRole
A path query finds relationships in the graph between two specified identity endpoints.

Paths are derived from the same graph used for the Relationship Graph view. The search is bounded by the current graph scope — account, assessment coverage, and included node types.

What a path represents

Each step in a path represents a supported IAM relationship: group membership, policy attachment, role trust, or another included relationship type. The path shows the structural chain of relationships between the two endpoints.

  • Group membership —user → group
  • Policy attachment —group → policy or role → policy
  • Role assumption —principal → role via trust relationship
  • Other supported relationships where represented in the collected graph.

A path does not mean access is proven

Important

A relationship path in the graph represents structural connectivity. Whether a path translates to executable access depends on applicable authorization controls: identity policy permissions, permission boundaries, SCPs, trust-policy conditions, explicit denies, and request context. Use Effective Permissions and Explain Access to investigate the authorization details.

Path found

A structural relationship chain exists between From and To

Use as a starting point for access investigation — not as proof of access.

No path found

No supported relationship chain exists in the graph scope

Does not prove no access path exists outside the current graph scope or assessment coverage.

Shortest path and bounded results

Access Path Explorer returns paths ordered by length, with the shortest relationship chain shown first. In large AWS environments, the number of possible paths can be very large. Results are bounded by the assessment graph scope — only relationships represented in the current graph are traversed.

Limitation

The explorer operates within the current graph scope. Relationships that exist in AWS but are not represented in the collected graph — for example, accounts not yet connected or resource types not yet covered — will not appear in the path results.

Access Path vs Attack Path

Access Path Explorer

Does a relationship path exist from A to B?

  • Structural: finds graph relationships
  • User-specified endpoints
  • Useful for investigating specific identity-to-identity connectivity

Attack Path / Privilege Escalation

Can available permissions and relationships create a stronger security capability?

  • Security reasoning applied to structural context
  • Automatically detected escalation paths
  • Useful for understanding privilege consequences

Use the Access Path Explorer when you have a specific From and To in mind. Use Privilege Escalation when you want Securitain to automatically detect security-relevant paths across the environment.

Access Path vs Relationship Graph

The Relationship Graph shows all relationships across the collected IAM environment. The Access Path Explorer focuses the view on the paths between two specific identities. Both draw from the same underlying graph.

  • Use the Relationship Graph for open-ended exploration — “what is connected to this identity?”
  • Use the Access Path Explorer for directed investigation — “is there a path from A to B?”

Investigating a path result

  1. 1

    Identify the source and target

    Determine the type and purpose of each identity — human user, workload role, CI/CD identity, federated role, or external principal.

  2. 2

    Review each step in the path

    Understand what each relationship represents. Is it a group membership? A policy attachment? A role trust? Each step matters.

  3. 3

    Investigate authorization details

    Use Effective Permissions to check which actions are actually available at each identity in the path. Use Explain Access to understand why a specific action is allowed, denied or indeterminate.

  4. 4

    Check security context of the target

    Determine the privilege level and security consequence associated with the target identity. Use Blast Radius for consequence context.

  5. 5

    Review related findings

    Check whether either identity or the path relationships surface in Privilege Escalation, Toxic Combinations or existing findings.

Evidence and limitations

Access path results depend on the completeness of the collected graph. Factors that can affect results include:

  • scan freshness — recently modified relationships may not yet be represented
  • account scope — only connected accounts are included
  • node types included in the current graph view
  • relationship types supported by the current assessment
  • AWS permissions available to the Securitain assessment role

Limitation

An empty path result means no supported relationship chain was found within the current graph scope. It does not prove that no access path exists in the live AWS environment.