<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Compliance Posture Audit — API Reference

## Prowler Commands

```bash
# AWS CIS Benchmark
prowler aws --compliance cis_3.0_aws --output-formats json

# AWS PCI DSS
prowler aws --compliance pci_3.2.1_aws --output-formats json-ocsf

# Azure CIS
prowler azure --compliance cis_2.1_azure

# GCP CIS
prowler gcp --compliance cis_2.0_gcp

# Specific services only
prowler aws --service iam s3 ec2 rds --output-formats json
```

## AWS Native Checks

```bash
# Unencrypted EBS volumes
aws ec2 describe-volumes --filters Name=encrypted,Values=false \
  --query 'Volumes[].VolumeId'

# Public S3 buckets
aws s3api list-buckets --query 'Buckets[].Name' --output text | \
  xargs -I{} aws s3api get-public-access-block --bucket {}

# Open security groups
aws ec2 describe-security-groups \
  --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]]'

# IAM users without MFA
aws iam get-credential-report --output text --query Content | \
  base64 -d | awk -F, '$4=="true" && $8=="false" {print $1}'

# CloudTrail status
aws cloudtrail describe-trails --query 'trailList[].{Name:Name,Multi:IsMultiRegionTrail}'

# RDS encryption
aws rds describe-db-instances \
  --query 'DBInstances[].{ID:DBInstanceIdentifier,Encrypted:StorageEncrypted}'
```

## Azure Native Checks

```bash
# Unencrypted disks
az disk list --query "[?encryption.type!='EncryptionAtRestWithPlatformKey']"

# NSG with open rules
az network nsg list --query "[].{Name:name,Rules:securityRules[?sourceAddressPrefix=='*']}"

# Storage account encryption
az storage account list --query "[].{Name:name,Encryption:encryption.services}"
```

## CIS Benchmark Scoring

| Section | AWS | Azure | GCP |
|---------|-----|-------|-----|
| IAM | 22 checks | 18 checks | 15 checks |
| Logging | 12 checks | 14 checks | 10 checks |
| Networking | 8 checks | 12 checks | 9 checks |
| Storage | 6 checks | 8 checks | 7 checks |
| Compute | 5 checks | 10 checks | 8 checks |
