Read Only Cloud Exposure Auditor
راقب · one who watches over
Point Raqib at the cloud you are signed in to. It reads your authorization configuration with read only calls, then reports the moves an intruder would make after a foothold, each with the change that closes it. The defensive mirror of an offensive framework, across AWS, Azure, GCP, and Kubernetes.
Raqib audits. Where the offensive framework it mirrors performs the escalation, plants the persistence, and pulls the data, Raqib only reads the configuration that would let those happen, and tells you to close it. Nothing it does changes a cloud.
Every call Raqib makes lists or describes authorization configuration. It has no code path that writes, and a guard refuses any command that is not one of the read only gather calls.
Raqib never creates, updates, or deletes a policy, a role, a binding, or anything else. You can run it against production and the account is exactly as it was.
An exfiltration finding checks whether a principal is allowed to read every secret. It never calls the API that returns the secret. The check is on the grant, not the data.
Raqib is Arabic for one who watches over, the observer who keeps watch, from the root ر ق ب, to watch and keep watch over. The name is the idea of the tool. A raqib watches and reports what it sees, it does not act. Raqib observes your cloud with read only calls and never touches it. A watcher, not an actor.
An attacker who lands one set of credentials maps the account, turns access into more, plants something to keep it, reaches the next principal, pulls data out, and turns off the logging. Raqib walks those same paths in your account and reports where each one is open.
These are the findings Raqib produces on deliberately built example accounts, the same output the tool prints. Switch the cloud, compare an exposed account with a clean one, and filter by severity. Open the full report, all 79 findings across four clouds →
The checks are a matrix under src/modules, named {tactic}_{cloud}.sh, the same six tactics the offensive framework runs, so the defense maps onto the offense one for one.
Each cloud has its own authorization model, so Raqib reads each one natively and reports the same six tactics in that cloud's own terms.
IAM policies, inline, attached, and group, with permissions boundaries.
iam get-account-authorization-detailsRBAC role assignments joined to role definitions, across actions and dataActions.
az role assignment list · role definition listIAM policy bindings, resolved to members with predefined and custom roles.
gcloud projects get-iam-policyRoles and ClusterRoles resolved to subjects through their bindings.
kubectl get clusterroles,roles,bindingsraqib.sh the launcher src/lib/ cloud_detect.sh detect and gather, read only utils.sh the read only guard model_{cloud}.jq one model per cloud src/modules/ {tactic}_{cloud}.sh the 24 checks src/report.sh terminal and json output raqib/ zero dependency python engine for offline review, SARIF, and the AWS credential report
Sign in the way you already do, then run Raqib. It needs jq and the CLI for the cloud you scan. Nothing else.
# clone and scan whatever cloud you are signed in to git clone https://github.com/SiteQ8/Raqib.git cd Raqib ./raqib.sh # one named cloud, and a build gate that fails on critical or high ./raqib.sh --cloud aws ./raqib.sh scan --strict # the whole cloud by tactic map, and offline review of a saved export ./raqib.sh defends ./raqib.sh scan --offline export.json