Cloudsplaining

No entries match these filters. Clear filters

1. 0.9.1 Jun 14, 2026 · release notes

   Cloudsplaining 0.9.1 sorts principals alphabetically by name in reports and quiets library logging noise.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.1 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.9.1

   • Sorts IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. principals alphabetically by name (instead of ID) in generated reports, making large reports easier to navigate.
   • Routes exclusion-match messages through logging instead of stdout, keeping library integrations quiet without changing CLI behavior.

   2 details in Everything

2. 0.9.0 Jun 14, 2026 · release notes

   Cloudsplaining 0.9.0 adds 37 new privilege-escalation detections linked to pathfinding.cloud for deeper IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. attack-path analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.0 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.9.0

   • Adds 37 new IAM privilege-escalation path detections linked to pathfinding.cloud for enriched attack-path context in reports.
   • Integrates pathfinding.cloud onboarding skill pipeline and safety tooling for guided privilege-escalation analysis.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported; environments running Python 3.9 will fail to install or run Cloudsplaining 0.9.0.
3. 0.9.0 Jun 14, 2026 · issue 007

   Cloudsplaining 0.9.0 adds 37 new privilege-escalation detections linked to pathfinding.cloud.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.9.0 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.9.0

   └──▷ TRY IT
   Generate a full account scan report that now includes pathfinding.cloud-linked privilege-escalation findings for all 37 new detection paths.
   copy

   $ cloudsplaining scan --input-file examples/files/example.json --exclusions-file examples/example-exclusions.yml --output examples/report/

   • Adds 37 new privilege-escalation path detections integrated with pathfinding.cloud, surfaced and linked directly in the HTML report.
   • Enriches the built-in example dataset to produce a higher-quality demo report with more representative findings.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported
   • !Node 18 and Node 22 are no longer supported
4. 0.8.2 Oct 10, 2025 · release notes

   Cloudsplaining 0.8.2 adds custom guidance and appendices support plus Python 3.14 compatibility.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.8.2 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.8.2

   • Supports custom guidance and appendices in reports, allowing practitioners to embed organization-specific remediation advice.
   • Supports Python 3.14.

   2 details in Everything

5. 0.8.1 Sep 30, 2025 · release notes

   Cloudsplaining 0.8.1 adds assume role support for scanning cross-account or role-based AWS environments.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.8.1 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.8.1

   • Adds assume role support, enabling Cloudsplaining to scan IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies by assuming a specified AWS role.

   1 detail in Everything

6. 0.7.0 Sep 15, 2024 · release notes

   Adds Python 3.13 support and performance improvements in Cloudsplaining 0.7.0.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.7.0 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.7.0

   • Improves performance with small optimizations

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.7 support is dropped; the tool no longer runs on Python < 3.8
   • !Node 16 is dropped from supported CI environments
7. 0.6.2 Oct 12, 2023 · release notes

   Cloudsplaining 0.6.2 adds internet-reachable check for ResourcePolicyDocument and extends credential exposure actions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6.2 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.6.2

   • Creates a ResourcePolicyDocument with an internet reachable check
   • Extends the list of actions exposing credentials

   2 details in Everything

8. 0.6.1 Aug 29, 2023 · release notes

   Cloudsplaining 0.6.1 adds --flag-all-risky-actions CLI flag and federated principal support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6.1 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.6.1

   └──▷ TRY IT
   Force the tool to flag every risky action without suppressing findings based on conditions.
   copy

   $ cloudsplain --flag-all-risky-actions ./policy.json

   • Adds --flag-all-risky-actions CLI argument to force all risky actions flagged regardless of conditions
   • Supports federated principals in analysis results

   2 details in Everything

9. 0.5.0 Feb 9, 2022 · release notes

   Cloudsplaining 0.5.0 adds noisy results flagging for risky actions regardless of resource constraints.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.5.0 https://github.com/salesforce/cloudsplaining.git
   # already have the repo? check out this version:
   $ git checkout 0.5.0

10. 0.2.5 Jan 20, 2021 · release notes

    Cloudsplaining 0.2.5 adds Deeplinks to report findings and links to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. API docs for every action.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.5 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.2.5

11. 0.2.4 Dec 10, 2020 · release notes

    CLI scan-policy-file command gains RoleLastUsed date field; improved inline explanations for findings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.4 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.2.4

    • scan-policy-file now includes the RoleLastUsed date in its output.
    • Findings now include inline explanations to describe the security impact of each finding.

    2 details in Everything

12. 0.2.3 Oct 12, 2020 · release notes

    Cloudsplaining 0.2.3 adds Credentials Exposure and Service Wildcard findings plus --minimize CLI flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.3 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.2.3

    └──▷ TRY IT
    Generate a smaller report by minimizing output data.
    copy

    $ cloudsplaining scan --minimize

    • Adds --minimize option to the scan command for reduced report size.
    • Adds Credentials Exposure as a new finding type in the UI.
    • Adds Service Wildcard as a new finding type in the UI.

    3 details in Everything

13. 0.2.2 Oct 6, 2020 · release notes

    Cloudsplaining 0.2.2 improves data file coverage and scan performance

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.2 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.2.2

    • Credentials Exposure findings are now included in the data.json output file.
    • Service Wildcard findings are now included in the data.json output file.
    • Exclusions are applied earlier in the scan pipeline, resulting in faster execution.

    3 details in Everything

14. 0.2.0 Sep 22, 2020 · release notes

    cloudsplaining v0.2.0 adds Service Wildcard and Credentials Exposure findings to scan-policy-file, migrates UI to Vue.js

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.0 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.2.0

    └──▷ USE IT
    Identify potential credential exposure risks within an IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy definition.
    shell copy

    cloudsplaining scan-policy-file ./role-policy.json --json

    • scan-policy-file command now returns findings about Service Wildcard
    • scan-policy-file command now returns findings about Credentials Exposure
    • Major UI uplift with new Bar chart for summary results and dedicated Inline Policies page

    3 details in Everything

15. 0.1.8 Aug 27, 2020 · release notes

    CLI flag --input-file replaces --input to specify input sources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.8 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.1.8

    └──▷ TRY IT
    Use the new flag name to specify an IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy file for analysis.
    copy

    $ cloudsplaining scan-policy-file --input-file my-policy.json

    • --input flag renamed to --input-file for all commands
    • Exclusions configuration now correctly displays in the report

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --input flag is renamed to --input-file, so existing commands using --input will fail.
16. 0.1.1 May 13, 2020 · release notes

    Adds a new Attached to Principals dropdown card for managing policy visibility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.1 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.1.1

    └──▷ HOW TO FIND IT
    View which IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. principals are attached to specific policies via the UI dropdown.
    📍Navigate to the IAM Principals tab and use the new Attached to Principals dropdown card for Customer-Managed and AWS-Managed Policies
    • Added "Attached to Principals" dropdown card for Customer-Managed and AWS-Managed Policies

    1 detail in Everything

17. 0.1.0 May 12, 2020 · release notes

    Adds risk-based sorting for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Principals in the Cloudsplaining CLI output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.0 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.1.0

    • IAM Principals table now supports sorting by risk level

    1 detail in Everything

18. 0.0.7 May 3, 2020 · release notes

    Cloudsplaining 0.0.7 adds a separate IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Principals tab and introduces object naming aligned with AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. API Data Types.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.0.7 https://github.com/salesforce/cloudsplaining.git
    # already have the repo? check out this version:
    $ git checkout 0.0.7

    • Changed the naming of some objects to make the object naming more in line with the AWS IAM API Data Types

    1 detail in Everything