CTM Cloud Threat Modeler

Pre-deploy threat review

Upload a Terraform plan and get a deterministic STRIDE-oriented readout.

The dashboard is intentionally thin. It runs the same engine as the CLI and renders the same evidence-backed findings, trust boundaries, observations, and machine-readable JSON contract.

What you get

  • Findings grouped by severity
  • Trust boundaries and observed controls
  • Raw JSON contract and markdown report
  • No cloud API calls or runtime dependencies

Analyze

Run the engine against a plan upload

Built-in scenarios

Run the curated fixture catalog in one click.

These demos are pulled from the same checked-in fixture plans used to exercise the analyzer in the repo. They make the project scope legible without asking someone to prepare Terraform first.

Calibrated baseline

sample_aws_safe_plan.json

Safe Plan

Mostly segmented AWS infrastructure with one deliberate IAM hygiene issue.

Findings
1
Boundaries
7
Resources
26
0 high 1 medium 0 low
Run built-in report

Representative mixed case

sample_aws_plan.json

Mixed AWS Plan

Public exposure, permissive database access, risky IAM, and broad trust in one reviewable plan.

Findings
9
Boundaries
9
Resources
23
3 high 6 medium 0 low
Run built-in report

Stress-case fixture

sample_aws_nightmare_plan.json

Nightmare Plan

Stacked public access, wildcard IAM, exposed storage, and high blast radius across the stack.

Findings
16
Boundaries
19
Resources
25
5 high 11 medium 0 low
Run built-in report

Common architecture

sample_aws_alb_ec2_rds_plan.json

ALB, EC2, and RDS

A common web architecture with an internet-facing load balancer, private app tier, and private RDS.

Findings
0
Boundaries
4
Resources
19
0 high 0 medium 0 low
Run built-in report

Control-plane focus

sample_aws_lambda_deploy_role_plan.json

Lambda Deploy Role

Private Lambda deployment path with scoped S3 access and deliberate trust-chain review points.

Findings
3
Boundaries
4
Resources
13
0 high 3 medium 0 low
Run built-in report

Trust expansion

sample_aws_cross_account_trust_unconstrained_plan.json

Cross-Account Trust

Minimal assume-role trust without narrowing conditions to exercise the IAM trust path directly.

Findings
2
Boundaries
2
Resources
2
0 high 2 medium 0 low
Run built-in report

Narrowed trust

sample_aws_cross_account_trust_constrained_plan.json

Constrained Trust

The same trust edge narrowed by ExternalId, SourceArn, and SourceAccount conditions.

Findings
0
Boundaries
2
Resources
2
0 high 0 medium 0 low
Run built-in report