DEV Community

Shreyansh Agrahari
Shreyansh Agrahari

Posted on Originally published at blastguard-cloud.vercel.app

Trace the Attack. Cut the Path. Prove It's Gone: Building BlastGuard with FalkorDB

#opensource #devops #security #cloud

Trace the Attack. Cut the Path. Prove It's Gone: Building BlastGuard with FalkorDB

How graph database traversals solve the transitive privilege escalation crisis in modern multi-cloud architectures. Built for the FalkorDB Graph Hacks Hackathon (Track 01: Agents That Act on Connected Data).

1. The Invisible Bridges in the Cloud

Modern cloud environments are dense networks of compute workloads, IAM roles, trust policies, service accounts, and data stores.

When your container scanner triggers an alert on a staging Kubernetes pod with an unauthorized interactive shell or vulnerable dependency, what is the typical reaction? Often, it gets deprioritized because "it's just staging; there is no customer data there."

That assumption is often catastrophically wrong.

In reality, cloud architectures are full of invisible bridges:

  • That staging pod executes as a Kubernetes service account (sa-payment-worker-stage).
  • That service account has trust permissions to assume an infrastructure deployment role in production (sts:AssumeRole -> ProductionDeployerRole).
  • That production deployment role inherits an overly permissive wildcard policy.
  • That policy grants full access to your company's crown jewels: the customer PII and backup database in production (prod-customer-pii-backups)!

Looking at individual alerts or reading static JSON policy documents cannot reveal transitive multi-hop attack paths.

To solve this, I designed and built BlastGuard — an autonomous cloud-security investigation and remediation platform powered by FalkorDB.

2. Why FalkorDB?

Relational databases require costly, nested recursive joins to traverse arbitrary relationship depths. Text-based search engines cannot model directional graph semantics.

FalkorDB is uniquely suited for this challenge because:

  1. Sub-Millisecond Cypher Traversals: Variable-length relationship queries execute in microseconds (O(k) traversal latency where k is the path depth).
  2. Operational Source of Truth: FalkorDB is not merely a decorative visualization cache; it actively decides which remediation actions are safe and mathematically verifies when attack paths are severed.
  3. Graph-Backed Agent Tools: Rather than relying on LLMs to guess permissions, the autonomous security agent queries FalkorDB for deterministic graph facts.

3. The Core Experience: Discover → Trace → Explain → Simulate → Verify

BlastGuard implements a cohesive 5-step operational workflow:

[Security Alert Ingested]
       ↓
1. DISCOVER: Query FalkorDB from affected workload
       ↓
2. TRACE: Multi-hop Cypher traversal to Tier-0 crown jewels
       ↓
3. EXPLAIN: Inspect chokepoint policies & evaluate collateral impact
       ↓
4. SIMULATE: Apply surgical revocation to FalkorDB relationship
       ↓
5. VERIFY: Recompute graph reachability; mathematically prove 0 remaining paths
       ↓
[Persist FalkorDB Audit Record]
Enter fullscreen mode Exit fullscreen mode

1. Discover & Trace

When an engineer selects an incident (such as ALERT-9041: Reverse Shell on Staging Pod), BlastGuard runs a parameterized Cypher traversal against FalkorDB:

MATCH path = (w:Workload {id: $workload_id})
  -[:EXECUTES_AS|CAN_ASSUME|HAS_POLICY|GRANTS_ACCESS_TO*1..6]->
  (target:Resource {tier: 'TIER_0_CRITICAL'})
RETURN path, length(path) AS hop_count
ORDER BY hop_count ASC
Enter fullscreen mode Exit fullscreen mode

Within microseconds, FalkorDB traces the exact 4-hop escalation path leading into production crown jewels.

2. Collateral Impact: Knowing What NOT to Break

The biggest fear in cloud remediation is causing a production outage. If an automated script blindly deletes an overly permissive role, critical production services might crash.

BlastGuard traverses the neighborhood of candidate chokepoint identities in FalkorDB to find modeled legitimate traffic (ACTIVE_TRAFFIC_TO). It detects that prod-nightly-backup-agent legitimate service also relies on that role.

Instead of deleting the production role, BlastGuard recommends the surgical least-privilege fix: severing the cross-account CAN_ASSUME trust relationship from staging to production. Staging is isolated, and production continuity is preserved!

3. Simulation & Mathematical Verification

BlastGuard generates a proposed Terraform HCL diff:

# Terraform Proposed Remediation Diff: Restrict IAM Role Trust Policy
# Target Resource: aws_iam_role.production_deployer
# File: infra/terraform/iam/roles.tf

 resource "aws_iam_role" "production_deployer" {
   name = "ProductionDeployerRole"

   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
-      {
-        Effect    = "Allow"
-        Action    = "sts:AssumeRole"
-        Principal = {
-          AWS = "arn:aws:iam::111122223333:role/k8s-sa-stage-payment"  # STAGING TRUST COMPROMISED
-        }
-      },
       {
         Effect    = "Allow"
         Action    = "sts:AssumeRole"
         Principal = {
           Service = "ec2.amazonaws.com"
         }
       }
     ]
   })
 }
Enter fullscreen mode Exit fullscreen mode

When the user approves the simulation:

  1. BlastGuard applies the mutation directly to the FalkorDB graph.
  2. A fresh verification traversal runs against the modified graph.
  3. It proves mathematically that remaining reachable paths equal 0.
  4. The alert status transitions to RESOLVED, and an immutable audit record is persisted.

4. Live Demo & Links

You can test BlastGuard right now in your browser:

5. Key Takeaways

Graph databases fundamentally change how we reason about cloud security. When you stop looking at individual vulnerabilities in silos and start analyzing connected relationship graphs, transitive threats become immediately visible and solvable.

Special thanks to WeMakeDevs, Kunal Kushwaha, and the FalkorDB team for organizing this hackathon!

I would love to hear your thoughts, feedback, and architecture questions in the comments!

Top comments (0)