AWSHound: An Open-Source AWS OpenGraph Collector

What it is

AWSHound is a read-only collector (open-sourced by Daniel Heinsen and a co-author at SpecterOps) that turns an AWS account or Organization into a BloodHound OpenGraph dataset. Source: https://github.com/AWSHound/AWSHound. SpecterOps is also accepting applications for an official enterprise AWS beta program.

How it works

Before drawing an edge, AWSHound runs an offline IAM evaluation and only creates the edge when a principal's effective permission resolves to Allow after identity policies, permission boundaries, SCPs, and RCPs have all applied. It then hands nodes/edges to BloodHound's existing path finding. The key insight the page adds beyond the summary: there is no single identity-plus-resource combination rule — it varies per service, so the tool models this explicitly.

• Identity-governed services (EC2, SSM, CloudFormation, EKS) check only the identity side; no resource policy gets a vote.
• Resource-policy services require both halves — notably, assuming a role needs both the trust policy and identity permission even inside a single account.
• KMS is modeled differently: three layers in order, all anchored on the key policy, first match wins — (1) direct key-policy match settles it, deny beats allow; (2) account-root delegation (kms:*) lets an IAM allow grant the action; (3) a collected KMS grant authorizes the operations it names, with grant constraints preserved on the edge.

Caveats

These are the operational limits the reader most needs, and they cut against the summary's simple "errs toward the attacker" framing:

• **KMS fails closed, not open.** A key policy AWSHound could not collect produces no edge — the opposite of its treatment of unknown conditions everywhere else.
• KMS collection is same-account-only today. A key policy in Account A naming a principal in Account B will not produce an edge, so cross-account KMS paths are silently missing.
• Conditions are three-valued. Runtime conditions (source IP, MFA, request tags, region) are unknown offline; AWSHound keeps allows it cannot disprove and drops denies it cannot confirm. Consequence: these are hypothetical candidate paths, not materialized ones — verify before acting.

flowchart TD
    R[Request: principal + action + resource + context] --> S{Service type}
    S -->|EC2/SSM/CFN/EKS| I[Identity side only]
    S -->|S3/role trust/etc| B[Identity AND resource policy]
    S -->|KMS| K1{Key policy direct match?}
    K1 -->|yes| K1r[Settles it; deny beats allow]
    K1 -->|no| K2{Root delegation kms:*?}
    K2 -->|yes| K2r[IAM allow grants]
    K2 -->|no| K3[KMS grant?]
    K1 -.uncollected key policy.-> FC[No edge — fails closed]