Static IaC threat modeler that parses Terraform, CloudFormation, and Kubernetes manifests and produces structured threat model reports using STRIDE, MITRE ATT&CK, or PASTA frameworks. No network calls, no cloud credentials, fully offline. Runs as a CLI, REST API, or containerized service.

Quick Start

CLI:

Docker:

REST API Server:

GraphQL API:

Supported Formats and Providers

Install

Install from PyPI:

Or for local development:

Usage

Scan a directory and print a Markdown report to stdout:

Scan multiple paths and write a JSON report to a file:

Generate an interactive HTML report or a SARIF report for GitHub Security:

CI gate — exit code 1 if any CRITICAL or HIGH threat is found:

Print a terminal summary table only, without writing a full report:

Use ASCII-only severity indicators (no emojis) for environments that don't support Unicode:

Analyze using different threat modeling frameworks:

Threat Modeling Frameworks

STRIDE (73 rules)

• Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
• Threat-centric approach ideal for identifying attack surface
• Provider-specific: AWS (22 rules), Azure (19 rules), GCP (15 rules), Kubernetes (17 rules)
• Best for: Traditional threat modeling, security architecture reviews

MITRE ATT&CK (11 rules, 14 tactics)

• Maps infrastructure threats to real-world adversary tactics and techniques
• Resource-aware technique selection for accurate TTP mapping
• Tactics: Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Collection, Command & Control, Exfiltration, Impact, Lateral Movement
• Best for: Aligning with threat intelligence, incident response planning, red team exercises

PASTA (12 rules, asset-centric)

• Process for Attack Simulation and Threat Analysis
• Asset-centric approach focusing on what needs protection
• Asset types: Data, Identity, Compute, Network, Infrastructure
• Threat actors: Internal, External, Misconfiguration, Supply Chain
• Best for: Risk-based prioritization, asset protection strategies, supply chain threats

Sample Report Output

Running threatmap scan ./examples --output report.md against the bundled examples produces a full Markdown report. Below is a representative excerpt.

STRIDE Threat Table

Mitigation Detail (excerpt)

Data Flow Diagram (Mermaid)

The report appends a Mermaid flowchart LR diagram. Nodes are coloured by worst-case severity (🔴 red = CRITICAL, 🟠 orange = HIGH). Paste the block into any Mermaid renderer or view it directly on GitHub.

Advanced Features (v2.1.0+)

Graph-based Attack Path Analysis

threatmap now includes Graph Intelligence that traces relationships between resources. It automatically identifies "chained" threats where a compromise of one resource (e.g., an internet-exposed EC2) leads directly to another (e.g., a private S3 bucket), flagging these as Elevation of Privilege attack paths.

Custom YAML Rules

You can define internal security requirements by creating a threatmap_rules.yaml in your project root.

Remediation Hints

Most findings now include a remediation field (visible in JSON, HTML, and SARIF reports) that provides the exact code snippet needed to fix the security issue.

Architecture

STRIDE Analyzer — Provider-specific threat rules:

MITRE ATT&CK Analyzer — 11 rules mapped to MITRE tactics:

• Resource-aware technique selection
• Supports: IAM, Storage, Network, Compute, Kubernetes, Databases
• Provides tactic→technique mapping for threat intelligence alignment

PASTA Analyzer — 12 rules with asset-centric focus:

• Classifies resources by asset type (data, identity, compute, network, infrastructure)
• Identifies threat actors (internal, external, misconfiguration, supply chain)
• Assigns attack scenarios for each threat

APIs:

• REST API: /health, /version, /rules, /analyze, /analyze/file
• GraphQL API: /graphql with Query (health, version, rules) and Mutation (analyze)

Each rule is a function that receives a Resource object (normalised from whatever source format was parsed) and returns a Threat if the condition is met. Rules are plain Python conditionals — no DSL, no regex engine, no external ruleset files.

How severities are assigned

Severity reflects both exploitability and blast radius:

How false positives are avoided

• No heuristics or ML — every rule fires on a concrete, unambiguous property value (e.g. publicly_accessible = true, Principal: "*").
• Conservative defaults — if a property is absent, the rule assumes the insecure default (e.g. no metadata_options block on an EC2 instance means IMDSv1 is active, because that is AWS's default).
• No cross-account or runtime state — the tool only looks at what is declared in the template. It does not attempt to infer what SCPs, permission boundaries, or runtime configs might mitigate a finding.
• Deduplication in the engine — findings are keyed on (stride_category, resource_name, trigger_property) so the same logical issue is never reported twice even if it appears across multiple file formats.

CI Integration

The --fail-on HIGH flag makes the job exit with code 1 if any HIGH or CRITICAL threat is found, blocking the PR merge. The uploaded artifact gives reviewers the full report without leaving the pull request.

STRIDE Rule Coverage

Categories covered per provider:

(S=Spoofing, T=Tampering, R=Repudiation, I=Information Disclosure, D=Denial of Service, E=Elevation of Privilege)

Development

Run tests:

Run with coverage:

Contributing

1. Fork the repository
2. Add rules in threatmap/analyzers/<provider>.py following the existing pattern
3. Add a fixture in tests/fixtures/ that triggers the new rule
4. Add assertions in tests/test_analyzers.py
5. Open a pull request