Raqib 0.7.0: resource policy exposure, and the name

Raqib now reads resource policies, the exposure the IAM export cannot show, and the repository now explains what the name means.

Resource policies

An IAM grant is who is allowed to do what. A resource policy is a bucket or a key left open to the world regardless of any identity. For AWS, Raqib now reads both.

• A new check reads S3 and KMS resource policies and flags a bucket open to the public through its policy, a bucket that grants another account access, a bucket public only under a condition, a bucket without a full public access block, a KMS key policy that allows any principal, and a key that trusts an external account.
• --exposure gathers these live, read only: list buckets and keys, get their policies, get the public access block. It reads the policy, it never reads an object or decrypts anything. --resource-policies FILE reads policies you already captured.
• This closes the gap open since the first release. Exfiltration read the permission to move data; now Raqib also reads the resource left open to the public.
• A new test pins the exposure findings on the sample. The suite is 103 tests. The browser explorer shows the findings in the AWS view.

The name

Raqib is راقب, Arabic for one who watches over, the observer who keeps watch, from the root that means to watch and keep watch over. The name is the idea of the tool. A raqib watches and reports what it sees, it does not act. Raqib observes your cloud with read only calls and never touches it. A watcher, not an actor.

./raqib.sh scan --exposure    also read S3 and KMS resource policies