Built-in scenarios

Run the curated fixture catalog in one click.

These demos are pulled from the same checked-in fixture plans used to exercise the analyzer in the repo. They make the project scope legible without asking someone to prepare Terraform first.

Back to upload

Quiet reference architecture

sample_aws_safe_plan.json

Safe Plan

Private-by-default AWS infrastructure with guarded storage, private database access, and no active findings.

Findings: 0
Boundaries: 6
Resources: 26

0 high 0 medium 0 low

Run built-in report

Calibrated baseline

sample_aws_baseline_plan.json

Baseline Plan

Mostly segmented AWS infrastructure with a small IAM hygiene issue and a non-obvious private-data path.

Findings: 2
Boundaries: 7
Resources: 26

0 high 2 medium 0 low

Run built-in report

Representative mixed case

sample_aws_plan.json

Mixed AWS Plan

Public exposure, permissive database access, risky IAM, and broad trust in one reviewable plan.

Findings: 9
Boundaries: 9
Resources: 23

3 high 6 medium 0 low

Run built-in report

Stress-case fixture

sample_aws_nightmare_plan.json

Nightmare Plan

Stacked public access, wildcard IAM, exposed storage, and high blast radius across the stack.

Findings: 16
Boundaries: 19
Resources: 25

5 high 11 medium 0 low

Run built-in report

Common architecture

sample_aws_alb_ec2_rds_plan.json

ALB, EC2, and RDS

A common web architecture where an internet-facing load balancer still composes into a private RDS access path.

Findings: 1
Boundaries: 4
Resources: 19

0 high 1 medium 0 low

Run built-in report

Container workload

sample_aws_ecs_fargate_plan.json

ECS / Fargate

Internet-facing ALB, private ECS tasks, RDS security-group trust, and Secrets Manager access through the task role.

Findings: 5
Boundaries: 6
Resources: 21

0 high 5 medium 0 low

Run built-in report

Control-plane focus

sample_aws_lambda_deploy_role_plan.json

Lambda Deploy Role

Private Lambda deployment path with scoped S3 access and deliberate trust-chain review points.

Findings: 3
Boundaries: 4
Resources: 13

0 high 3 medium 0 low

Run built-in report

Trust expansion

sample_aws_cross_account_trust_unconstrained_plan.json

Cross-Account Trust

Minimal assume-role trust without narrowing conditions to exercise the IAM trust path directly.

Findings: 2
Boundaries: 2
Resources: 2

0 high 2 medium 0 low

Run built-in report

Narrowed trust

sample_aws_cross_account_trust_constrained_plan.json

Constrained Trust

The same trust edge narrowed by ExternalId, SourceArn, and SourceAccount conditions.

Findings: 0
Boundaries: 2
Resources: 2

0 high 0 medium 0 low

Run built-in report