<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Incident Response — API Reference

## AWS CLI Commands

### CloudTrail Investigation

```bash
# Lookup events by username
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=$USER \
  --start-time "2026-03-15T00:00:00Z" --output json

# Lookup events by event source
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=iam.amazonaws.com \
  --output json
```

### IAM Containment

```bash
# Apply DenyAll policy
aws iam put-user-policy --user-name $USER --policy-name IncidentDenyAll \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}'

# Deactivate access keys
aws iam update-access-key --user-name $USER --access-key-id $KEY_ID --status Inactive

# List attached policies
aws iam list-attached-user-policies --user-name $USER
```

### EC2 Forensics

```bash
# Snapshot volumes
aws ec2 create-snapshot --volume-id vol-xxx --description "IR Evidence"

# Isolate with security group
aws ec2 modify-instance-attribute --instance-id i-xxx --groups sg-isolate
```

## Azure CLI Commands

### Activity Log

```bash
az monitor activity-log list --start-time "2026-03-15" --caller "user@company.com" --output json
```

### Containment

```bash
# Block user sign-in
az ad user update --id "user@company.com" --account-enabled false

# Revoke sessions
az ad user revoke-sessions --id "user@company.com"
```

## GCP Commands

### Audit Logs

```bash
gcloud logging read 'protoPayload.authenticationInfo.principalEmail="user@company.com"' \
  --project=$PROJECT --freshness=7d --format=json
```

### Containment

```bash
# Disable service account
gcloud iam service-accounts disable $SA_EMAIL --project=$PROJECT

# Remove IAM bindings
gcloud projects remove-iam-policy-binding $PROJECT --member="user:$EMAIL" --role="$ROLE"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `--lookup-attributes` | CloudTrail search filter | `AttributeKey=Username,AttributeValue=admin` |
| `--start-time` | Event start filter (ISO 8601) | `2026-03-15T00:00:00Z` |
| `--policy-document` | IAM policy JSON | `{"Version":"2012-10-17",...}` |
| `--account-enabled` | Azure AD account state | `false` |
| `--freshness` | GCP log age filter | `7d` |
