Raqib v0.15.0

Raqib v0.15.0

A score command that turns a scan into an answer to the next question, what do I fix first, and a real bug fix it surfaced along the way.

score

raqib.sh score runs a scan and then rates it:

• A grade from A to F and a number out of 100, from a weighted count of the findings by severity.
• The principals that carry the most risk, ranked, worst severity and most findings first, each with the change that closes it, so there is a clear order to work in rather than a flat list.
• A rollup by tactic.

It reads the same findings the scan prints, so raqib.sh score, raqib.sh score --offline export.json, and python -m raqib score export.json all work, with --json for the machine readable form. In both the bash scanner and the Python engine.

A bug the score surfaced

Building the score compared the two engines by severity, not just by count, and caught a real divergence: the bash GCP model tested a public member against the ambient input instead of the principal, so allUsers and allAuthenticatedUsers were read as broad data access rather than the critical "a role is granted to everyone" finding they are. The Python engine was already correct. Fixed, and the two now agree.

A stronger guarantee

The parity test now compares the two engines finding for finding, on severity, tactic, and principal, not only on the total, so a divergence like that one cannot pass again.

Quality

• 145 tests pass, the bash scanner and the Python engine in lockstep on every cloud.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.14.0

Raqib v0.14.0

Deepens the last two tactics, reconnaissance and defense evasion, on the clouds where they were still thin. With this, all four clouds cover the six tactics in depth. Both the bash scanner and the Python engine gain the checks and stay in lockstep.

Reconnaissance

• GCP: reading the project IAM policy, which enumerates every member and the role they hold, the same map an intruder draws first that the AWS check already flags.
• Kubernetes: reading the cluster RBAC, the roles and bindings that map who can do what.

Defense evasion

• GCP: redirecting log routing by updating a sink, and deleting alert policies so nothing fires, alongside deleting sinks and logs.
• Azure: lowering the Microsoft Defender for Cloud plan, which turns off threat detection, alongside deleting diagnostic settings and Log Analytics workspaces.

The picture

Every tactic is now read in depth on every cloud. The interactive report at siteq8.github.io/Raqib/report.html shows all 83 example findings, and raqib.sh defends prints the whole cloud by tactic map.

Quality

• New sample principals for each path and four new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 141 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.13.0

Raqib v0.13.0

A rebuilt browser explorer that finally shows the whole tool, plus a small text fix. No change to the checks.

The explorer, across four clouds

The example report at siteq8.github.io/Raqib/report.html was a static AWS only page. It is now an interactive report across AWS, Azure, GCP, and Kubernetes that shows every finding the engine produces:

• A cloud by tactic matrix at the top, the six tactics read across every cloud at a glance.
• Live filtering by cloud, attacker tactic, severity, and free text, with the summary counts updating as you filter.
• Every finding carries its severity, the principal it concerns, the change that closes it, and the MITRE ATT&CK technique it defends against.
• The findings are written into the page, so it reads with no script and the filtering is progressive enhancement on top.

Docs that cannot drift

A new generator, docs/build_explorer.py, runs the engine over the samples and rebuilds both the explorer and the landing page, including its version. The landing explorer had been showing an old, partial finding set; it now reflects the current build, and stays in step with the engine on every change.

Also

• Fixed a hyphen in one finding text to match the house style.
• 137 tests pass, the bash scanner and the Python engine still in lockstep.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.12.0

Raqib v0.12.0

Deepens exfiltration coverage on Azure, GCP, and Kubernetes. With this release, all four clouds cover the six tactics in depth, from reconnaissance and privilege escalation through persistence, lateral movement, and exfiltration. Both the bash scanner and the Python engine gain the checks and stay in lockstep.

Azure exfiltration

• Minting a SAS token that shares a storage account out, a shareable URL to its blobs.
• Exporting a disk or snapshot as a downloadable image, a full copy of a machine.
• Reading Cosmos DB keys, which open every database in the account.

GCP exfiltration

• Creating storage HMAC keys, interoperable credentials that read Cloud Storage from anywhere, outside the project audit.
• Exporting a Cloud SQL database to a bucket.

Kubernetes exfiltration

• Reading pod logs, which leak secrets, tokens, and data. The bash and Python engines are now aligned here: both weigh secrets, config maps, and logs, and leave a subject that can only read secrets to the lateral movement check, so there is no duplicate finding.

A milestone

Across four releases, coverage of the non-AWS clouds has grown from the primary paths to full depth on every tactic. raqib.sh defends prints the whole cloud by tactic map.

Quality

• New sample principals for each path and four new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 137 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.11.0

Raqib v0.11.0

Deepens lateral movement coverage on Azure, GCP, and Kubernetes, and fixes a bug in the Azure model. Both the bash scanner and the Python engine gain the checks and stay in lockstep, as the parity test asserts.

GCP lateral movement

• A default service account with a broad role. The Compute Engine, App Engine, and Google APIs default service accounts are attached to compute by default, so Editor or Owner on one is a pivot: a foothold on a VM or a function inherits that reach.
• A group holding Owner or Editor. The membership is managed outside the project, so who actually holds the access is not visible in the IAM policy.

Kubernetes lateral movement

• Reaching the kubelet on nodes through nodes/proxy, which runs commands in the pods on a node and reads their logs and mounted tokens.
• Port forwarding to pods, a tunnel to a pod and any service reachable from it.

Azure lateral movement

• An identity that spans multiple subscriptions, a single compromised principal that reaches across them.

Fix

• The bash Azure model kept only the last role assignment for a principal that held several, because it merged assignments with the wrong operator. It now accumulates every assignment, matching the Python engine. This was latent until a principal held roles in two subscriptions; the parity test now covers it.

Quality

• New sample principals for each path and six new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 133 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.10.0

Raqib v0.10.0

Deepens persistence coverage on Azure, GCP, and Kubernetes, bringing each closer to the AWS depth. Both the bash scanner and the Python engine gain the checks and stay in lockstep, as the parity test asserts.

Azure persistence

• Federated identity credential on a managed identity. Adding one lets an external OIDC issuer authenticate as that identity with no secret to rotate, a modern and stealthy back door.
• Automation account. A durable, scheduled execution surface that can run as a managed identity.

GCP persistence

• Lasting access to a service account. Setting the IAM policy on a service account binds a principal an intruder controls as a token creator, a back door into that identity that leaves no key behind.
• Scheduled job. A Cloud Scheduler job an intruder can use to re-trigger a callback and return.

Kubernetes persistence

• Role bindings across namespaces, binding a controlled subject to a role and keeping a foothold, alongside the cluster role bindings already covered.
• Service account creation, a fresh identity to bind and return through.

Quality

• New sample principals for each path and six new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 127 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.9.0

Raqib v0.9.0

Three changes: deeper privilege escalation on Azure and Kubernetes, a wider AWS exposure scan, and a new diff command for posture drift. Both the bash scanner and the Python engine gain each change and stay in lockstep, as the parity test asserts.

Azure privilege escalation, deeper

• Run as a managed identity. Running a command or installing an extension on a VM, writing an Automation runbook, or assigning a user assigned managed identity all execute as that identity.
• Write role definitions. The roleDefinitions/write check now also runs in the bash scanner, not only the Python engine.

Kubernetes privilege escalation, deeper

• Workloads that create pods. Creating or changing deployments, daemonsets, statefulsets, jobs, and the like spawns pods that can reach the node, not just direct pod creation.
• Exec into pods, taking over a workload and the token mounted in it.
• Mint service account tokens, and self approve a certificate signing request to authenticate as any user or group.

AWS exposure, wider

• --exposure now reads SQS queue, SNS topic, Lambda function, and Secrets Manager secret resource policies in addition to S3 and KMS, flagging any left open to the public or another account. The read only gather allowlist gains the matching list and get calls.

New: diff for posture drift

• raqib.sh diff OLD.json NEW.json scans two exports and reports which findings appeared and which resolved between them. Add --strict to exit non zero on any new finding, for a pipeline that fails on new exposure. The Python engine has the same command.

Quality

• 121 tests pass. New checks each fire on a sample and stay quiet on the least privilege sample; the bash scanner and the Python engine produce the same findings on every cloud.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib v0.8.0

Raqib v0.8.0

Deepens GCP privilege escalation so it reads the documented escalation paths, not just Owner and impersonation, bringing GCP closer to the AWS depth. Both the bash scanner and the Python engine gain the checks and stay in lockstep.

New GCP escalation paths

• Act as a service account to deploy and run as it. The GCP form of passing a role: a member that can act as a service account and create a Cloud Function, a Compute Engine instance, or a Cloud Run service runs with that account permissions. Reported per target, with the generic actAs finding kept as the fallback.
• Rewrite a custom role granted to the member. With iam.roles.update on a role it holds, a member can add permissions to itself.
• Run as a powerful default service account. Starting a Cloud Build build runs as the Cloud Build service account, and creating a Deployment Manager deployment runs as the Google APIs service account, both Editor on the project by default.
• Impersonation broadened. Now also catches signing as a service account and minting OpenID tokens, not only access tokens.

Quality

• New sample principals for each path and six new tests. The parity test still asserts the bash scanner and the Python engine produce the same findings on every sample. 109 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.

Raqib 0.7.0: resource policy exposure, and the name

Raqib now reads resource policies, the exposure the IAM export cannot show, and the repository now explains what the name means.

Resource policies

An IAM grant is who is allowed to do what. A resource policy is a bucket or a key left open to the world regardless of any identity. For AWS, Raqib now reads both.

• A new check reads S3 and KMS resource policies and flags a bucket open to the public through its policy, a bucket that grants another account access, a bucket public only under a condition, a bucket without a full public access block, a KMS key policy that allows any principal, and a key that trusts an external account.
• --exposure gathers these live, read only: list buckets and keys, get their policies, get the public access block. It reads the policy, it never reads an object or decrypts anything. --resource-policies FILE reads policies you already captured.
• This closes the gap open since the first release. Exfiltration read the permission to move data; now Raqib also reads the resource left open to the public.
• A new test pins the exposure findings on the sample. The suite is 103 tests. The browser explorer shows the findings in the AWS view.

The name

Raqib is راقب, Arabic for one who watches over, the observer who keeps watch, from the root that means to watch and keep watch over. The name is the idea of the tool. A raqib watches and reports what it sees, it does not act. Raqib observes your cloud with read only calls and never touches it. A watcher, not an actor.

./raqib.sh scan --exposure    also read S3 and KMS resource policies

Raqib 0.6.0: AWS credential report in the live scanner

The bash scanner now reads the AWS credential report, so its AWS coverage matches the Python engine: not only what IAM policy allows, but the credential hygiene the policy cannot show.

New in 0.6.0

• A new check reads the AWS credential report and flags a root account with an active access key or no multi factor authentication, a console user without a second factor, a user with two active keys, and an access key that is old and still active.
• --credentials gathers the report live, read only. It runs generate-credential-report and get-credential-report, which describe the account and change no principal, no policy, no role.
• --credential-report FILE reads a report you already captured, and --max-key-age DAYS sets what counts as an old key, ninety days by default.
• A new test drives raqib.sh over every sample and asserts it matches the Python engine, credential report included, so the bash and python paths cannot drift apart. The suite is 102 tests.
• The browser explorer at the demo now shows the credential findings in the AWS view.

Still true

Read only, always. Raqib reads who can do what, and reports it with the fix. It never creates, changes, or deletes anything, and never reads the contents of a secret, an object, or a key.

./raqib.sh                    scan the cloud you are signed in to
./raqib.sh scan --credentials also read the AWS credential report
./raqib.sh defends            the whole cloud by tactic map