<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secure Cloud Architecture — API Reference

## agent.js CLI

```bash
# Assess cloud security posture
node scripts/agent.js --action assess --provider aws

# Design landing zone
node scripts/agent.js --action design --provider aws --pattern multi-account

# Generate guardrails (SCPs)
node scripts/agent.js --action guardrails --provider aws --output scps.json

# Validate architecture
node scripts/agent.js --action validate --provider aws --config architecture.json
```

## AWS Security CLI

```bash
# Enable CloudTrail
aws cloudtrail create-trail --name org-trail --s3-bucket-name trail-bucket \
  --is-multi-region-trail --is-organization-trail --enable-log-file-validation

# Enable GuardDuty
aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES

# Enable Security Hub
aws securityhub enable-security-hub --enable-default-standards

# Create SCP
aws organizations create-policy --name "security-guardrails" \
  --type SERVICE_CONTROL_POLICY --content file://scp.json

# Enable Config
aws configservice put-configuration-recorder --configuration-recorder \
  '{"name":"default","roleARN":"arn:aws:iam::role/config","recordingGroup":{"allSupported":true}}'
```

## Azure Security CLI

```bash
# Enable Defender for Cloud
az security pricing create --name VirtualMachines --tier Standard

# Create management group
az account management-group create --name "Security" --display-name "Security OU"

# Enable Azure Policy
az policy assignment create --name "require-encryption" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/POLICY_ID"
```

## GCP Security CLI

```bash
# Enable Security Command Center
gcloud scc organizations describe $ORG_ID

# Create organization policy
gcloud org-policies set-policy policy.yaml --organization=$ORG_ID

# Enable audit logging
gcloud projects set-iam-policy $PROJECT policy.yaml
```

## Shared Responsibility Model

| Layer | Provider Manages | Customer Manages |
|-------|-----------------|------------------|
| Physical | ✓ | |
| Network infra | ✓ | |
| Hypervisor | ✓ | |
| OS (IaaS) | | ✓ |
| Runtime (PaaS) | ✓ | |
| Application | | ✓ |
| Data | | ✓ |
| Identity | Shared | Shared |
| Network config | | ✓ |
