dAWShund - framework to put a leash on naughty AWS permissions

This report presents dAWShund, a blue-team-oriented framework that enumerates AWS IAM identity and resource policies (sAWSage), evaluates effective permissions using AWS’s SimulatePrincipalPolicy API (Gerakina), and maps allowed relationships into Neo4j/BloodHound (dAWShund) for analysis; it explains AWS policy types, data collection tradeoffs, and provides example Cypher queries to identify risky configurations, highlighting how built-in AWS capabilities can expose misconfigurations while aiding defenders and red teams.