Raqib v0.14.0

Raqib v0.14.0

Deepens the last two tactics, reconnaissance and defense evasion, on the clouds where they were still thin. With this, all four clouds cover the six tactics in depth. Both the bash scanner and the Python engine gain the checks and stay in lockstep.

Reconnaissance

• GCP: reading the project IAM policy, which enumerates every member and the role they hold, the same map an intruder draws first that the AWS check already flags.
• Kubernetes: reading the cluster RBAC, the roles and bindings that map who can do what.

Defense evasion

• GCP: redirecting log routing by updating a sink, and deleting alert policies so nothing fires, alongside deleting sinks and logs.
• Azure: lowering the Microsoft Defender for Cloud plan, which turns off threat detection, alongside deleting diagnostic settings and Log Analytics workspaces.

The picture

Every tactic is now read in depth on every cloud. The interactive report at siteq8.github.io/Raqib/report.html shows all 83 example findings, and raqib.sh defends prints the whole cloud by tactic map.

Quality

• New sample principals for each path and four new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 141 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.