<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Misconfiguration Templates — API Reference

## Nuclei Cloud Scanning Options

```bash
# Scan S3 bucket
nuclei -u https://bucket.s3.amazonaws.com -t s3-misconfig.yaml -json

# Scan with cloud provider tag filter
nuclei -u https://target.com -tags cloud,aws -json

# Bulk scan cloud assets
nuclei -l cloud-assets.txt -t cloud-templates/ -json -o results.json
```

## Cloud-Specific Response Headers

| Provider | Header | Indicates |
|----------|--------|-----------|
| AWS | `x-amz-request-id` | S3/AWS service response |
| AWS | `x-amz-bucket-region` | S3 bucket region |
| Azure | `x-ms-request-id` | Azure service response |
| Azure | `x-ms-version` | Azure API version |
| GCP | `x-guploader-uploadid` | GCS upload response |

## Cloud Metadata Endpoints

| Provider | Endpoint | Purpose |
|----------|----------|---------|
| AWS | `169.254.169.254/latest/meta-data/` | Instance metadata |
| AWS | `169.254.169.254/latest/meta-data/iam/` | IAM role credentials |
| GCP | `metadata.google.internal/computeMetadata/v1/` | Instance metadata |
| Azure | `169.254.169.254/metadata/instance` | Instance metadata |

## Storage Enumeration Patterns

| Provider | Pattern | Detection |
|----------|---------|-----------|
| AWS S3 | `<ListBucketResult` | Directory listing |
| Azure Blob | `<EnumerationResults` | Container listing |
| GCP GCS | `<ListBucketResult` | Bucket listing |
| Firebase | JSON response on `/.json` | Open database |

## DSL Functions for Cloud Detection

| Function | Usage | Description |
|----------|-------|-------------|
| `contains()` | `contains(body, "ami-id")` | Check for cloud metadata |
| `len()` | `len(body) > 2` | Verify non-empty response |
| `tolower()` | `tolower(all_headers)` | Case-insensitive header check |
| `regex()` | `regex(body, "arn:aws:.*")` | Match AWS ARN patterns |
