Cloud infrastructure detection with resource path tracing

1. A computer-implemented method of streamlined analysis of infrastructure posture of a cloud environment, the method comprising:

accessing permissions data and access control data for pairs of compute resources and storage resources in the cloud environment;

tracing network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data; and

constructing a cloud infrastructure map that graphically depicts the pairs of the compute resources and the storage resources as nodes, and the network communication paths as edges between the nodes.

2. The computer-implemented method of claim 1 , and further comprising:

in response to a query specifying at least one search term, graphically returning a subset of the pairs of the compute resources and the storage resources as containing searched content based on content inspection of the subset of the pairs of the compute resources and the storage resources.

3. The computer-implemented method of claim 2 , wherein the cloud infrastructure map graphically returns, based on the permissions data and the access control data, those compute resources and storage resources that have access to the subset of the pairs of the compute resources and the storage resources.

4. The computer-implemented method of claim 1 , and further comprising:

in response to a query specifying at least one content category, graphically returning a subset of the pairs of the compute resources and the storage resources as containing searched content category based on content inspection of the subset of the pairs of the compute resources and the storage resources.

5. The computer-implemented method of claim 4 , wherein the cloud infrastructure map graphically returns, based on the permissions data and the access control data, those compute resources and storage resources that have access to the subset of the pairs of the compute resources and the storage resources.

6. The computer-implemented method of claim 1 , and further comprising:

in response to a query specifying at least one data privacy law, graphically returning a subset of the pairs of the compute resources and the storage resources as complying with a given data privacy law based on content inspection of the subset of the pairs of the compute resources and the storage resources, and evaluation of permissions data and access control data of the subset of the pairs of the compute resources and the storage resources.

7. The computer-implemented method of claim 6 , wherein the cloud infrastructure map graphically returns, based on the permissions data and the access control data, those compute resources and storage resources that have access to the subset of the pairs of the compute resources and the storage resources.

8. The computer-implemented method of claim 1 , wherein the cloud infrastructure map graphically depicts metadata associated with the pairs of the compute resources and the storage resources.

9. The computer-implemented method of claim 1 , and further comprising graphically filtering the cloud infrastructure map based on a filter criterion.

10. The computer-implemented method of claim 9 , wherein the filter criterion represents one or more applications running on at least one of the pairs of the compute resources and the storage resources.

11. The computer-implemented method of claim 9 , wherein the filter criterion represents one or more networks in the cloud environment.

12. The computer-implemented method of claim 9 , wherein the filter criterion represents owners of computer resources and storage resources.

13. The computer-implemented method of claim 9 , wherein the filter criterion represents at least one of a creation time or date of computer resources and storage resources.

14. The computer-implemented method of claim 1 , wherein, in response to a query specifying at least one temporal period, the cloud infrastructure map graphically returns at least one prior state of compute resources and storage resources.

15. The computer-implemented method of claim 14 , wherein the state includes at least one of a permissions state, an access control state, or a sensitivity data classification state.

16. The computer-implemented method of claim 1 , wherein the cloud infrastructure map graphically depicts anomalous configured access instances in the cloud environment.

17. The computer-implemented method of claim 16 , wherein the anomalous configured access instances are detected as different levels of access among compute resources and storage resources that connect to a common network component.

18. A computing system comprising: at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:

access permissions data and access control data for pairs of compute resources and storage resources in a cloud environment;

trace network communication paths between the pairs of the compute resources and the storage resources based on the permissions data and the access control data; and

construct a cloud infrastructure map that graphically depicts the pairs of the compute resources and the storage resources as nodes, and the network communication paths as edges between the nodes.

19. The computing system of claim 18 , wherein the cloud infrastructure map graphically depicts anomalous actual access instances in the cloud environment.

20. The computing system of claim 18 , wherein the cloud infrastructure map graphically receives user-annotated tags for compute resources and storage resources, wherein the user-annotated tags are stored with a unique identifier, and filterable and removably in response to a query specifying the unique identifier.

21. The computing system of claim 18 , wherein the instructions cause the computing system to graphically filter the cloud infrastructure map based on stale accesses of those compute resources that have not accessed connected storage resources over a specified time period.

22. The computing system of claim 18 , wherein the network communication paths include read access paths from compute resources to storage resources.

23. The computing system of claim 18 , wherein the network communication paths include write access paths from compute resources to storage resources.

24. The computing system of claim 18 , wherein the network communication paths include synchronization access paths between storage resources.

25. The computing system of claim 18 , wherein the risk criterion indicates at least one of:

a width of configured access to compute resources and storage resources, the width of configured access being defined by a number of workloads configured with access;

a number of users with access to compute resources and storage resources; different types of workloads configured with access; or

volume or type of sensitive data.

26. A computer-implemented method of streamlined analysis of infrastructure policy posture of a cloud environment, the computer-implemented method comprising:

accessing policy data, permissions data, and access control data for pairs of compute resources and storage resources in the cloud environment;

tracing network communication paths between the pairs of the compute resources and the storage resources based on the policy data, the permissions data, and the access control data; and

constructing a cloud infrastructure map that graphically depicts the pairs of the compute resources and the storage resources as nodes, and the network communication paths as edges between the nodes.

27. The computer-implemented method of claim 26 , wherein the policy data includes identity-based policies.

28. The computer-implemented method of claim 26 , wherein the policy data includes resource-based policies.

29. The computer-implemented method of claim 26 , wherein the policy data includes permissions boundaries.

30. The computer-implemented method of claim 26 , wherein the policy data includes service control policies.