Think of Cartography as Google Maps for your cloud infrastructure — except instead of showing you coffee shops, it shows you every IAM permission, every network link, and every potential attack path across AWS, Azure, GCP, and beyond. Cartography reads your cloud APIs and builds a knowledge graph that makes your entire infrastructure searchable and auditable. If you have ever tried to answer “which S3 bucket can this Lambda access?” by clicking through twelve consoles, Cartography is the tool that turns that into a five-second query.
Version 0.139.0 is a monster release. It adds five entirely new cloud integrations, introduces condition-aware IAM modeling that can finally tell you what your permissions actually do, and brings a whole new set of compliance and supply-chain features. If you manage infrastructure across multiple clouds, this is the release that makes Cartography feel like a complete platform rather than a collection of connectors.
New Integrations Everywhere
This release adds more new integrations than some projects ship in a year. Here are the highlights.
Scaleway Gets Full Coverage
Scaleway — the European cloud provider — is now a first-class citizen in Cartography with comprehensive coverage across ten separate pull requests. If your org runs workloads on Scaleway (and a surprising number of European companies do), you can now map your entire Scaleway footprint into the same graph as your AWS and GCP resources.
The integration covers compute instances and bare-metal servers, VPC and IPAM networking, object storage, Kapsule managed Kubernetes, container registries, managed databases (RDB, Redis, MongoDB), serverless functions and public gateways, DNS and domain management, key and secret management, SSH keys, and IAM permissions with full code-to-cloud tracing.
This means you can finally answer questions like “which of our Scaleway databases are reachable from the internet?” or “which IAM users have access to production Kapsule clusters?” — all from the same Neo4j graph that already holds your AWS and GCP data.
# Example: find all internet-exposed Scaleway instances
MATCH (n:ScalewayInstance)-[:EXPOSED]->(e:ScalewayPublicGateway)
RETURN n.name, e.endpointScaleway coverage spans ten PRs: security groups (#2952), object storage (#2963), VPC and load balancers (#2965), DNS and secrets (#2966), Kubernetes and container registry (#2967), managed databases (#2970), serverless (#2975), complete resource coverage (#2981), IAM and code-to-cloud (#2985), and Elastic Metal IPs (#2988).
Databricks Gets a Full Intel Module
Databricks joins the Cartography intel lineup with a comprehensive five-part integration that covers workspace identity, compute resources, secrets, IP access lists, Unity Catalog (metastore, catalogs, grants), jobs, SQL warehouses, ML serving, Delta Sharing, and full account-level configuration with permission resolution.
For organizations running data platforms on Databricks, this means you can now trace exactly who has access to what — from a Delta table all the way back to the IAM role that spawned the cluster. That is the kind of visibility that auditors dream about.
# Example: find all users with access to a Unity Catalog metastore
MATCH (u:User)-[:HAS_ACCESS]->(g:Grant)-[:GRANTS_ON]->(c:Catalog)
WHERE c.metastore_id = $metastore_id
RETURN u.username, c.name, g.privilegeDatabricks coverage spans five PRs: identity (#2968), compute, secrets, and IP access (#2969), Unity Catalog (#2976), jobs, SQL, ML, and Delta Sharing (#2982), and account, permissions, and rules (#2996).
Salesforce and CircleCI Join the Party
Two more SaaS platforms are now mappable. Salesforce gets an intel module that maps users, access patterns, and connected apps (#3005). CircleCI gets its own intel module for CI/CD pipeline visibility (#2921).
Both follow the same intel module pattern — they surface identity, access, and configuration data into the graph so you can ask questions like “which Salesforce admin also has CircleCI project admin access?” Cross-tool attack path analysis, basically.
Smarter IAM and Security Rules
Condition-Aware IAM Permissions
This is arguably the most architecturally significant change in the release. Cartography now models conditions on IAM permission relationships for both AWS and GCP (#2891).
Here is why that matters: an IAM policy that grants s3:GetObject with a condition restricting it to a specific bucket tag is fundamentally different from the same permission without that condition. Before 0.139.0, Cartography treated both identically — which meant your attack path analysis could flag permissions as dangerous when the conditions made them harmless in practice.
Now, condition constraints are part of the graph model. Your security findings will have fewer false positives, and the paths Cartography traces will actually reflect what your IAM policies allow, not just what their principal actions say.
Treating a conditioned permission the same as an unconditional one is like treating a door with a combination lock the same as one that is standing wide open. They are technically both “doors,” but one of them is not letting anyone through.
Workload Identity Edges
A new set of ASSUMES and RUNS_AS edges now link EC2 instances and Azure VMs and Function Apps to their workload identities (#2998). This makes it straightforward to trace the full chain: “this pod runs on this VM, which assumes this role, which has this policy.”
Combined with the condition-aware permissions above, you now have a surprisingly complete picture of how identity flows through your infrastructure.
CIS Rule Accuracy Improvements
Two separate PRs tackle false positive reduction in the compliance rules engine. #2958 adds firewall relevancy signals and reduces false positives in cloud security rules. #2983 improves CIS rule accuracy across AWS, GCP, and Kubernetes by aligning finding cardinality.
If you have ever been buried in Cartography findings that turned out to be noise, these changes should thin the herd considerably.
Supply-Chain and Vulnerability Intelligence
The ontology gains supply-chain relationship constraints (#3008), and the CVE metadata module now derives effect tags from CWE and CVSS data (#3003). NVD API requests are now batched (#2945), which means faster syncs and fewer API rate-limit headaches.
Kubernetes NetworkPolicy and Container Ports
Cartography now models Kubernetes NetworkPolicy resources and captures container listening ports (#3014). This fills a notable gap — knowing which ports your containers expose is half the battle when it comes to network segmentation. Combined with the existing Kubernetes node and pod modeling, you can now reason about your cluster network topology from the graph.
Other Notable Additions
- GCP API Keys are now ingested from
apikeys.googleapis.com(#2960). - Azure Key Vault secret tags and GCP Cloud Function labels are now ingested (#2974).
- Tailscale devices are now linked to cloud instances (#3010).
- GitHub CODEOWNERS ownership is now surfaced as evidence (#2940).
- Tag ontology gets a unified
:Tagextra label (#2973). - Microsoft credential config gets a canonical representation (#2944).
Bug Fixes and Reliability
As usual, the team shipped a stack of reliability fixes that make the syncing experience less painful. Microsoft Graph API calls now retry on transient 500/502 errors (#2989). Okta retries non-JSON SDK errors across paged requests (#2999). GCP Cloud Run retries on transient 5xx responses (#3000). BigQuery sync no longer aborts on invalidQuery errors (#2972), and BigQuery CMEK rules are now scoped to persistent tables aggregated by dataset (#2979).
Also worth noting: AWS IAM SAML provider sync no longer crashes on AccessDenied (#2953), and GitHub PAT ontology timestamps are now properly normalized (#2950).
Five new contributors made their first contribution in this release, including @Vansh-Sharma27 who fixed the BigQuery invalidQuery handling.
Cartography 0.139.0 is available now. If your cloud estate spans more than one provider, this is the release that finally lets you see the whole board.
