<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Security Remediation — API Reference

## AWS CLI — S3 Security

```bash
# List all buckets
aws s3api list-buckets --query 'Buckets[].Name'

# Check public access block
aws s3api get-public-access-block --bucket BUCKET_NAME

# Enable public access block
aws s3api put-public-access-block --bucket BUCKET_NAME \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Check bucket encryption
aws s3api get-bucket-encryption --bucket BUCKET_NAME

# Enable default encryption
aws s3api put-bucket-encryption --bucket BUCKET_NAME \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

# Check bucket policy
aws s3api get-bucket-policy --bucket BUCKET_NAME
```

## AWS CLI — Security Groups

```bash
# Find open security groups
aws ec2 describe-security-groups --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]].[GroupId,GroupName]'

# Revoke open rule
aws ec2 revoke-security-group-ingress --group-id sg-xxxx --protocol tcp --port 22 --cidr 0.0.0.0/0

# Describe specific SG
aws ec2 describe-security-groups --group-ids sg-xxxx
```

## AWS CLI — IAM

```bash
# Generate credential report
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

# List access keys
aws iam list-access-keys --user-name USER

# Check MFA
aws iam list-mfa-devices --user-name USER

# List policies attached to user
aws iam list-attached-user-policies --user-name USER

# Get account authorization details
aws iam get-account-authorization-details --filter User
```

## boto3 Python SDK

```python
import boto3

# S3
s3 = boto3.client('s3')
s3.list_buckets()
s3.get_public_access_block(Bucket='name')
s3.put_public_access_block(Bucket='name', PublicAccessBlockConfiguration={...})

# EC2
ec2 = boto3.client('ec2')
ec2.describe_security_groups()
ec2.revoke_security_group_ingress(GroupId='sg-xxx', IpPermissions=[...])

# IAM
iam = boto3.client('iam')
iam.list_users()
iam.list_access_keys(UserName='user')
iam.list_mfa_devices(UserName='user')
iam.generate_credential_report()
```

## AWS Config Rules (Managed)

| Rule | Description |
|------|-------------|
| `s3-bucket-public-read-prohibited` | S3 no public read |
| `s3-bucket-ssl-requests-only` | Enforce HTTPS |
| `ec2-security-group-attached-to-eni` | SGs must be in use |
| `restricted-ssh` | No 0.0.0.0/0 on port 22 |
| `iam-user-mfa-enabled` | MFA required |
| `access-keys-rotated` | Keys rotated within 90 days |
| `encrypted-volumes` | EBS encryption |
| `cloudtrail-enabled` | CloudTrail active |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No misconfigurations found |
| 1 | Misconfigurations detected or remediated |
| 2 | API error or insufficient permissions |
