Dependency map

The dependency map (/map) shows how your resources relate to one another, so you can see what a change would touch before you make it.

What an edge is

Every edge is typed and directed. The direction carries meaning: A in_vpc B reads “A is in VPC B”, not the reverse.

Category	Types
Network	in_vpc, in_subnet, attached_to
Security groups	member_of_security_group, allows_traffic_from
IAM	assumes_role
References	targets, references

The map’s filter chips group by those four categories.

Where edges come from

Edges are extracted from the configuration discovery already collected. Nothing extra is read from AWS to build the graph, and no agent runs inside your account.

That has a consequence worth knowing: Aletheia can only see relationships that appear in the configuration it stores. Where a link exists only in a part of a resource’s configuration that discovery does not snapshot, it is counted as an unresolved reference rather than drawn as an edge. The extraction run reports how many of those it hit, so the gap is visible rather than silent.

Active and stale edges

Re-extraction diffs against what was there before. An edge that no longer appears is marked stale, not deleted, and keeps its first- and last-observed timestamps.

Being able to see that two resources used to be connected, and when that stopped, is usually more useful than the edge quietly vanishing.

Reading the map

• Focus — the map is always drawn around a focus node.
• Depth — how many hops out from the focus. Bounded, because an unbounded graph on a large estate is a picture of nothing.
• Direction — dependencies, dependents, or both.
• Type filters — narrow to the categories above.

Where a node has more neighbours than the view will draw, they collapse into a +N node you can expand. The map tells you it truncated rather than silently showing you part of the picture.

The current view is in the URL, so a specific view is a link you can send.

Evidence

Select any edge to see why it exists: which resource’s configuration, which field, and what value produced it. An edge you cannot inspect is indistinguishable from a guess, so every one can be opened.

Extraction runs

Extraction runs automatically after discovery. You can also trigger a run for an account by hand. A run reports how many resources it scanned, how many edges it created or marked stale, and how many references it could not resolve.

Where to go next

• Resources — every resource page carries its own dependencies.
• Applications, environments and ownership for dependencies aggregated per application.