Zeem Cloud Posture Scanner 3.4 adds Entra ID and GKE Autopilot checks

The open-source scanner now ships 128 read-only checks across AWS, Azure, GCP and Microsoft 365, exports to SARIF and CSV, and runs in a container with a scoped audit role. Release notes and file hashes inside.

Version 3.4 of our open-source posture scanner is out. It now ships 128 read-only checks across AWS, Azure, Google Cloud and Microsoft 365.

What is new

• Entra ID checks — consent settings, privileged role assignment hygiene, legacy authentication, and conditional access coverage gaps.
• GKE Autopilot baselines — workload identity, binary authorisation, and the shielded-node settings Autopilot does not enforce for you.
• SARIF export, so findings land in GitHub code scanning alongside your other results.
• Faster inventory on large AWS organisations: parallel account enumeration cuts a 200-account sweep from hours to minutes.

Read-only, by design

Every check uses a read call. The scanner never writes, never deletes, and refuses to start if the role it is given carries write permissions — a guard we added after a user pointed a production admin role at it.

Run it with the scoped audit role documented in the repository, not with an administrator credential.

Running it

The container image is the supported path. Mount your credentials read-only, pick the providers you want, and point the output at a directory. A full four-provider sweep on a mid-sized estate finishes in about twelve minutes.

Findings come out as JSON, CSV and SARIF at the same time, so you can pipe one into a ticket queue and another into code scanning without a second run.

Verify what you download

Every release ships with SHA-256 hashes and a signature. Verify both before you run anything — including builds of ours. The hashes are published on the release page, not only in the archive, so a tampered archive cannot vouch for itself.

Upgrading from 3.3

The configuration format is unchanged and 3.3 config files work as-is. The only breaking change is in the JSON output: findings now carry a stable checkId instead of the positional index that earlier versions used, which matters if you were diffing results between runs.