<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Cloud Compliance Automation — API Reference

## AWS Config

```bash
# Enable Config
aws configservice put-configuration-recorder --configuration-recorder name=default,roleARN=ROLE_ARN

# Deploy conformance pack
aws configservice put-conformance-pack --conformance-pack-name NAME --template-s3-uri S3_URI

# Compliance summary
aws configservice get-compliance-summary-by-config-rule

# Non-compliant resources
aws configservice get-compliance-details-by-config-rule --config-rule-name RULE --compliance-types NON_COMPLIANT

# Auto-remediation
aws configservice put-remediation-configurations --remediation-configurations '[...]'
```

## AWS Security Hub

```bash
# Enable Security Hub
aws securityhub enable-security-hub --enable-default-standards

# Enable CIS standard
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[{"StandardsArn":"arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0"}]'

# Get failed findings
aws securityhub get-findings --filters '{"ComplianceStatus":[{"Value":"FAILED","Comparison":"EQUALS"}]}'
```

## Azure Policy

```bash
# List initiatives
az policy set-definition list --query "[?policyType=='BuiltIn']"

# Assign initiative
az policy assignment create --name NAME --policy-set-definition ID --scope SCOPE

# Check compliance
az policy state summarize

# Create remediation
az policy remediation create --name NAME --policy-assignment ID
```

## GCP Organization Policy

```bash
# List constraints
gcloud org-policies list --organization=ORG_ID

# Set policy
gcloud org-policies set-policy --organization=ORG_ID POLICY_FILE

# SCC findings
gcloud scc findings list ORG_ID --filter='category="COMPLIANCE_VIOLATION"'
```

## Compliance Framework Mapping

| Control | AWS | Azure | GCP |
|---------|-----|-------|-----|
| CIS Benchmark | Config Conformance Pack | Policy Initiative | SCC Health Analytics |
| SOC2 | Security Hub + Config | Defender for Cloud | SCC + Org Policy |
| HIPAA | Config + Macie | Azure Policy HIPAA | SCC + DLP |
| PCI-DSS | Config PCI Pack | Policy PCI Initiative | SCC PCI module |
