Auditing AWS infrastructure with Neo4j: questions inventory cannot answer

Somebody asks whether GuardDuty covers every account. The question is about holes in the coverage, not about whether the service is switched on. From a flat resource inventory that is a genuinely annoying question. You export accounts, export detectors, line them up in a spreadsheet, and the answer is stale the moment anyone runs terraform apply. It is annoying because it is not an inventory question. It asks about a missing relationship between two things you already have, and a list is the wrong shape for that. A relationship here is a conceptual claim as much as a stored fact. It records what the estate is meant to do, where that intent came from, and how it is enforced. A detector’s scope asserts coverage, and security group rules and routes assert reachability, both of them typically expressed as rules or infrastructure as code. Modelling an edge means modelling that intent next to the observation. Most questions worth asking about an estate are like this. Which internet-facing thing reaches the database. Which accounts can genuinely reach each other, whatever the network diagram claims. The audit boundary is the set of accounts a compliance scope such as SOC 2 covers, which is…