Summarizer Output (Step 1)
{
"app_summary": "Two EC2 instances (both stopped) without public IPs and without IAM instance profiles: i-0601780d500bb51ea \"First Instance\" in subnet-0b8c568bc3659b486 (172.31.27.120, t2.medium) and i-0322a28bf1a8a68c5 \"Second Instance\" in subnet-05c9a438bb7c68867 (172.31.87.12, t2.micro). Both associated to security group sg-090ff45d5d6ad1cd4 (rules not evidenced).",
"boundary_label": "Authorization Boundary: AWS Account 154776478584 (us-east-1) / VPC 172.31.0.0/16",
"data_summary": "No RDS instances, S3 buckets, or other data stores evidenced. EC2 uses EBS volumes (count=3) but volumes are not enumerated; treat as attached block storage within the authorization boundary.",
"flow_labels": {
"admin_flow": "Administrator access via AWS",
"app_to_data": "EC2 \u2194 Attached EBS volumes (",
"ingress_flow": "Internet \u2192 IGW \u2192 VPC routing",
"log_flow": "Workloads/VPC \u2192 Logging serv",
"user_flow": "Internet user traffic (not e"
},
"grouping_hints": {
"data_tier": "Show \u0027EBS (attached storage)\u0027 as a data component associated with each EC2 instance; do not introduce RDS/S3. Optionally add a dashed \u0027Data Services (not evidenced)\u0027 placeholder only if a renderer requires a dedicated data tier container.",
"perimeter": "Place \u0027Internet\u0027 outside the authorization boundary; show Internet Gateway at the boundary edge connecting into the VPC. Since no public endpoints are evidenced, keep inbound arrows as \u0027potential\u0027 and label accordingly.",
"security": "Render Security Group sg-090ff45d5d6ad1cd4 as an inline control attached to both EC2 nodes; render \u0027NACL (1) + Route Table (1)\u0027 as subnet/VPC-level controls without rule detail; render \u0027IAM (account control plane)\u0027 outside the VPC but inside the account boundary.",
"subnets": "Group all six subnets under a single container \u0027Public Subnets (map_public_ip_on_launch=true, 6 AZs)\u0027 with two inner lanes: lane A contains subnet-0b8c568bc3659b486 (1d) hosting First Instance; lane B contains subnet-05c9a438bb7c68867 (1c) hosting Second Instance; remaining subnets listed as empty capacity."
},
"layout_hints": {
"legend_position": "right",
"responsive_canvas": true,
"side_panels": true,
"subnet_columns": 2,
"support_panel_position": "left"
},
"network_summary": "VPC vpc-033668c99bb7641b0 (172.31.0.0/16) with Internet Gateway igw-0c2d9b6f737cc026e attached. Six subnets (all map_public_ip_on_launch=true): subnet-0b3e792cb9abb6b15 (1b, 172.31.0.0/20), subnet-0b8c568bc3659b486 (1d, 172.31.16.0/20), subnet-0c567848e2f3285b9 (1a, 172.31.32.0/20), subnet-006336d9696975386 (1e, 172.31.48.0/20), subnet-06c23e873cdba6e94 (1f, 172.31.64.0/20), subnet-05c9a438bb7c68867 (1c, 172.31.80.0/20). No NAT/VPC endpoints evidenced.",
"overview": "Single default VPC with 6 public subnets and 2 stopped EC2 instances. Internet Gateway attached; no NAT Gateways, no VPC Endpoints, and no managed data stores evidenced. Logging services (CloudTrail/CloudWatch Logs/VPC Flow Logs) not evidenced.",
"placeholder_sections": [
"management_path",
"cloudtrail",
"cloudwatch_logs",
"vpc_flow_logs"
],
"security_summary": "IAM present (users/roles/password policy/credential report counts) but specific principals not provided; depict IAM as an account-level control plane element. Network controls evidenced: security groups (3 total; only sg-090ff45d5d6ad1cd4 referenced by instances), a network ACL (1), and a route table (1) without rule details. Monitoring/telemetry not evidenced (CloudTrail=0, CloudWatch Log Groups=0, VPC Flow Logs=0).",
"style_goals": [
"Single clear authorization boundary around the VPC with an external \u0027Internet\u0027 zone and IGW at the perimeter",
"Minimize subnet clutter by grouping subnets as \u0027Public Subnets (6, multi-AZ)\u0027 while still listing subnet IDs/AZs in a legend/side panel",
"Use dashed placeholder elements for missing-but-expected governance/logging paths (management and audit logging) clearly labeled as \u0027not evidenced\u0027"
],
"title": "AWS us-east-1 VPC (vpc-033668c99bb7641b0) Authorization Boundary \u0026 Data Flow"
}
Evidence JSON (Audit Trail)
{
"account_id": "154776478584",
"counts": {
"assets": [
{
"count": 3,
"resource_type": "ebs_volume"
},
{
"count": 2,
"resource_type": "ec2_instance"
}
],
"data_stores": [],
"identities": [
{
"count": 1,
"resource_type": "iam_credential_report"
},
{
"count": 1,
"resource_type": "iam_password_policy"
},
{
"count": 4,
"resource_type": "iam_role"
},
{
"count": 5,
"resource_type": "iam_user"
}
],
"network_components": [
{
"count": 1,
"resource_type": "internet_gateway"
},
{
"count": 1,
"resource_type": "network_acl"
},
{
"count": 1,
"resource_type": "route_table"
},
{
"count": 3,
"resource_type": "security_group"
},
{
"count": 6,
"resource_type": "subnet"
},
{
"count": 1,
"resource_type": "vpc"
}
]
},
"ingestion_run_id": "4f6cda72-e405-4f30-9bde-aa3f17639f45",
"notes": {
"no_hallucination": true,
"resource_types_supported": [
"vpc",
"subnet",
"internet_gateway",
"nat_gateway",
"vpc_endpoint",
"vpc_flow_log",
"ec2_instance",
"rds_instance",
"s3_bucket",
"cloudtrail_trail",
"cloudwatch_log_group"
],
"sample_limit": 50
},
"resources": {
"cloudtrail_trails": [],
"cloudwatch_log_groups": [],
"ec2_instances": [
{
"account_id": "154776478584",
"data": {
"ebs_optimized": false,
"iam_instance_profile": null,
"instance_id": "i-0601780d500bb51ea",
"instance_type": "t2.medium",
"launch_time": "2022-09-10T16:59:37Z",
"monitoring_enabled": false,
"private_ip": "172.31.27.120",
"public_ip": null,
"security_group_ids": [
"sg-090ff45d5d6ad1cd4"
],
"state": "stopped",
"subnet_id": "subnet-0b8c568bc3659b486",
"tags": {
"Name": "First Instance"
},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "32a0eba7-e121-4edc-b1c1-bffef2933ace",
"region": "us-east-1",
"resource_id": "i-0601780d500bb51ea",
"resource_type": "ec2_instance"
},
{
"account_id": "154776478584",
"data": {
"ebs_optimized": false,
"iam_instance_profile": null,
"instance_id": "i-0322a28bf1a8a68c5",
"instance_type": "t2.micro",
"launch_time": "2022-09-20T23:57:09Z",
"monitoring_enabled": false,
"private_ip": "172.31.87.12",
"public_ip": null,
"security_group_ids": [
"sg-090ff45d5d6ad1cd4"
],
"state": "stopped",
"subnet_id": "subnet-05c9a438bb7c68867",
"tags": {
"Name": "Second Instance"
},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "5e7c6ca8-9065-4bcc-9165-dc107f489b27",
"region": "us-east-1",
"resource_id": "i-0322a28bf1a8a68c5",
"resource_type": "ec2_instance"
}
],
"internet_gateways": [
{
"account_id": "154776478584",
"data": {
"attachments": [
{
"State": "available",
"VpcId": "vpc-033668c99bb7641b0"
}
],
"internet_gateway_id": "igw-0c2d9b6f737cc026e",
"tags": {}
},
"id": "7ba32aea-41e3-41ff-ad43-ae942914a211",
"region": "us-east-1",
"resource_id": "igw-0c2d9b6f737cc026e",
"resource_type": "internet_gateway"
}
],
"nat_gateways": [],
"rds_instances": [],
"s3_buckets": [],
"subnets": [
{
"account_id": "154776478584",
"data": {
"availability_zone": "us-east-1d",
"available_ip_address_count": 4090,
"cidr_block": "172.31.16.0/20",
"map_public_ip_on_launch": true,
"state": "available",
"subnet_id": "subnet-0b8c568bc3659b486",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "0ca7e857-501a-4579-9f30-b196928262be",
"region": "us-east-1",
"resource_id": "subnet-0b8c568bc3659b486",
"resource_type": "subnet"
},
{
"account_id": "154776478584",
"data": {
"availability_zone": "us-east-1a",
"available_ip_address_count": 4091,
"cidr_block": "172.31.32.0/20",
"map_public_ip_on_launch": true,
"state": "available",
"subnet_id": "subnet-0c567848e2f3285b9",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "0163976f-cd7a-4344-89e7-21923ede5856",
"region": "us-east-1",
"resource_id": "subnet-0c567848e2f3285b9",
"resource_type": "subnet"
},
{
"account_id": "154776478584",
"data": {
"availability_zone": "us-east-1f",
"available_ip_address_count": 4091,
"cidr_block": "172.31.64.0/20",
"map_public_ip_on_launch": true,
"state": "available",
"subnet_id": "subnet-06c23e873cdba6e94",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "6de8f5bc-f770-4210-8378-7e35eb23fb8d",
"region": "us-east-1",
"resource_id": "subnet-06c23e873cdba6e94",
"resource_type": "subnet"
},
{
"account_id": "154776478584",
"data": {
"availability_zone": "us-east-1c",
"available_ip_address_count": 4090,
"cidr_block": "172.31.80.0/20",
"map_public_ip_on_launch": true,
"state": "available",
"subnet_id": "subnet-05c9a438bb7c68867",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "e784ece9-6419-44d7-9377-18245fcb7131",
"region": "us-east-1",
"resource_id": "subnet-05c9a438bb7c68867",
"resource_type": "subnet"
},
{
"account_id": "154776478584",
"data": {
"availability_zone": "us-east-1b",
"available_ip_address_count": 4091,
"cidr_block": "172.31.0.0/20",
"map_public_ip_on_launch": true,
"state": "available",
"subnet_id": "subnet-0b3e792cb9abb6b15",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "c9ced59b-6593-4686-a676-5f738af9753e",
"region": "us-east-1",
"resource_id": "subnet-0b3e792cb9abb6b15",
"resource_type": "subnet"
},
{
"account_id": "154776478584",
"data": {
"availability_zone": "us-east-1e",
"available_ip_address_count": 4091,
"cidr_block": "172.31.48.0/20",
"map_public_ip_on_launch": true,
"state": "available",
"subnet_id": "subnet-006336d9696975386",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "9941a8ef-7fbb-44f9-b1da-eef0274aac63",
"region": "us-east-1",
"resource_id": "subnet-006336d9696975386",
"resource_type": "subnet"
}
],
"vpc_endpoints": [],
"vpc_flow_logs": [],
"vpcs": [
{
"account_id": "154776478584",
"data": {
"cidr_block": "172.31.0.0/16",
"dhcp_options_id": "dopt-0823549fe54a61393",
"instance_tenancy": "default",
"is_default": true,
"state": "available",
"tags": {},
"vpc_id": "vpc-033668c99bb7641b0"
},
"id": "10082cf8-7102-4134-a934-89c21d1accc0",
"region": "us-east-1",
"resource_id": "vpc-033668c99bb7641b0",
"resource_type": "vpc"
}
]
}
}