Blast Radius Explained: The 1-Hop Graph for Cloud Actions
Before you stop, resize, or delete a resource, list what is directly connected to it and how each connection reacts.
Blast radius is the set of other resources affected when you change one. Deleting a database breaks the services that query it; stopping an instance removes capacity behind a load balancer; resizing a node pool recreates its nodes. A blast radius check answers “what else gets hit, and how badly” before the change runs rather than during the incident.
Why one hop
A 1-hop adjacency graph lists only the resources directly connected to the target, one edge away. It deliberately ignores neighbors of neighbors. The trade-off is explicit: a full reachability graph can show more, but it grows quickly and buries the direct dependencies an operator can actually check. The cost of the choice is that second-order effects, such as the clients of a service whose database you are deleting, are not in the view.
How ZopNight builds the graph
ZopNight’s blast radius analysis builds an adjacency graph server-side from resource metadata it already discovers. Six edge types are detected:
| Edge | Detected from |
|---|---|
db_access | AWS shared security group, GCP shared network, Azure shared subnet |
routes_to | load balancer target metadata |
attached_to | a volume or disk’s attached-to metadata |
triggers | Lambda trigger sources, Cloud Run event sources |
member_of | a resource’s parent |
cross_region | connection resources that record a source and target |
The graph is cached per organization and invalidated when resources are discovered or deleted, so it follows inventory rather than a fixed rebuild cycle.
Classifying impact
Impact depends on the operation and the edge. Each neighbor is marked safe, warning, or affected.
- Modify is classified by how the target type changes. Online-modify types such as Lambda, EBS, S3, and ECS services update live, so connections are safe. Restart-modify types such as EC2, VMs, RDS, Cloud SQL, and ElastiCache briefly go offline, so a load balancer in front is a warning and a Kubernetes pool parent is affected. Pool-modify types such as GKE node pools, EKS node groups, AKS agent pools, ASGs, VMSS, and MIGs recreate their child nodes, which are affected.
- Delete and stop are classified by edge. Deleting a parent affects its members; deleting a resource with a trigger breaks the trigger; deleting across a
db_accessedge is affected when the target is the database and safe when it is the compute side. Stopping a host is safe for attached storage and deleting it leaves attached storage detached with data preserved (a warning), and a stop across adb_accessedge to a database is a warning because connections drop. Cross-region pairs are a warning for either operation.
Anything not explicitly proven safe defaults to warning.
The risk score
A 0 to 100 score is computed in the browser from three parts: how much of the neighborhood is affected (affected counts fully, warning counts half, up to 60 points), the environment (production 15, staging 8, development 3, and zero when nothing is impacted), and ownership spread across teams and schedules (up to 20 points). If everything is safe, the score is 0. On the architecture canvas the target is blue, affected neighbors red, warnings amber, safe neighbors green, and unrelated resources dimmed.
Blast radius is available for single resources, for autoscaler policies (using the policy’s scaling target), and for schedules, where editing or deleting a schedule shows its attached resources and groups with their cost impact.
What it does not know
The current analysis has clear limits: it looks only one hop out; no blast radius for teams, resource groups, or cloud accounts; connections are inferred from metadata, not from network traffic or flow logs; and it does not know how much redundancy exists, for example how many other targets sit behind the same load balancer. Treat a warning on a load-balanced instance accordingly.
Blast radius is most useful right before remediation; see also the how-to on viewing it before you click Remediate and ordering start and stop across a group.
Questions we get a lot.
If yours isn't here, email us and we'll answer directly.
Why does a stop on an instance show attached volumes as safe?
Stopping a host preserves attached storage, so an attached_to edge is classified safe for stop. Deleting the host is classified as a warning: the volume is detached and its data preserved.
Does blast radius use network flow logs?
No. In v1, edges are inferred from resource metadata such as shared security groups, load balancer targets, attachments, triggers, and parent relationships, not from observed traffic.
Can I see blast radius for a whole resource group?
Not in v1. It is supported for single resources, autoscaler policies, and schedules. For schedules, attached resource groups are shown as expandable children.