Raqib 0.6.0: AWS credential report in the live scanner

The bash scanner now reads the AWS credential report, so its AWS coverage matches the Python engine: not only what IAM policy allows, but the credential hygiene the policy cannot show.

New in 0.6.0

• A new check reads the AWS credential report and flags a root account with an active access key or no multi factor authentication, a console user without a second factor, a user with two active keys, and an access key that is old and still active.
• --credentials gathers the report live, read only. It runs generate-credential-report and get-credential-report, which describe the account and change no principal, no policy, no role.
• --credential-report FILE reads a report you already captured, and --max-key-age DAYS sets what counts as an old key, ninety days by default.
• A new test drives raqib.sh over every sample and asserts it matches the Python engine, credential report included, so the bash and python paths cannot drift apart. The suite is 102 tests.
• The browser explorer at the demo now shows the credential findings in the AWS view.

Still true

Read only, always. Raqib reads who can do what, and reports it with the fix. It never creates, changes, or deletes anything, and never reads the contents of a secret, an object, or a key.

./raqib.sh                    scan the cloud you are signed in to
./raqib.sh scan --credentials also read the AWS credential report
./raqib.sh defends            the whole cloud by tactic map