<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Cloud Vulnerability Scanning

## Prowler CLI

| Command | Description |
|---|---|
| `prowler aws` | Full AWS assessment |
| `prowler aws --compliance cis_2.0_aws` | CIS benchmark scan |
| `prowler aws --service s3 iam` | Service-specific scan |
| `prowler aws --severity critical high` | Severity filter |
| `prowler azure --compliance cis_2.1_azure` | Azure CIS scan |
| `prowler gcp --compliance cis_2.0_gcp` | GCP CIS scan |
| `-M json` | JSON output format |
| `-M html` | HTML dashboard report |

## Trivy CLI

| Command | Description |
|---|---|
| `trivy image <image>` | Scan container image |
| `trivy fs <path>` | Scan filesystem |
| `trivy config <path>` | Scan IaC configurations |
| `--severity CRITICAL,HIGH` | Severity filter |
| `--format json -o <file>` | JSON output |

## AWS CLI Security Checks

| Command | Description |
|---|---|
| `aws s3api get-bucket-acl --bucket <name>` | Check bucket ACL |
| `aws ec2 describe-security-groups` | List security groups |
| `aws iam generate-credential-report` | IAM credential report |
| `aws ec2 describe-volumes --filters encrypted=false` | Unencrypted volumes |

## Agent Script

```bash
# Prowler AWS CIS scan
node agent.js prowler aws --compliance cis_2.0_aws

# Trivy container scan
node agent.js trivy nginx:latest

# Check public S3 buckets
node agent.js check-s3

# Check open security groups
node agent.js check-sg
```
