Raqib v0.10.0
Raqib v0.10.0
Deepens persistence coverage on Azure, GCP, and Kubernetes, bringing each closer to the AWS depth. Both the bash scanner and the Python engine gain the checks and stay in lockstep, as the parity test asserts.
Azure persistence
- Federated identity credential on a managed identity. Adding one lets an external OIDC issuer authenticate as that identity with no secret to rotate, a modern and stealthy back door.
- Automation account. A durable, scheduled execution surface that can run as a managed identity.
GCP persistence
- Lasting access to a service account. Setting the IAM policy on a service account binds a principal an intruder controls as a token creator, a back door into that identity that leaves no key behind.
- Scheduled job. A Cloud Scheduler job an intruder can use to re-trigger a callback and return.
Kubernetes persistence
- Role bindings across namespaces, binding a controlled subject to a role and keeping a foothold, alongside the cluster role bindings already covered.
- Service account creation, a fresh identity to bind and return through.
Quality
- New sample principals for each path and six new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 127 tests pass.
Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.