Raqib v0.9.0

Raqib v0.9.0

Three changes: deeper privilege escalation on Azure and Kubernetes, a wider AWS exposure scan, and a new diff command for posture drift. Both the bash scanner and the Python engine gain each change and stay in lockstep, as the parity test asserts.

Azure privilege escalation, deeper

• Run as a managed identity. Running a command or installing an extension on a VM, writing an Automation runbook, or assigning a user assigned managed identity all execute as that identity.
• Write role definitions. The roleDefinitions/write check now also runs in the bash scanner, not only the Python engine.

Kubernetes privilege escalation, deeper

• Workloads that create pods. Creating or changing deployments, daemonsets, statefulsets, jobs, and the like spawns pods that can reach the node, not just direct pod creation.
• Exec into pods, taking over a workload and the token mounted in it.
• Mint service account tokens, and self approve a certificate signing request to authenticate as any user or group.

AWS exposure, wider

• --exposure now reads SQS queue, SNS topic, Lambda function, and Secrets Manager secret resource policies in addition to S3 and KMS, flagging any left open to the public or another account. The read only gather allowlist gains the matching list and get calls.

New: diff for posture drift

• raqib.sh diff OLD.json NEW.json scans two exports and reports which findings appeared and which resolved between them. Add --strict to exit non zero on any new finding, for a pipeline that fails on new exposure. The Python engine has the same command.

Quality

• 121 tests pass. New checks each fire on a sample and stay quiet on the least privilege sample; the bash scanner and the Python engine produce the same findings on every cloud.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.