<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Cloud Storage Misconfigurations — API Reference

## AWS S3

```bash
# Public access block
aws s3api get-public-access-block --bucket BUCKET
aws s3api put-public-access-block --bucket BUCKET \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

# Bucket policy status
aws s3api get-bucket-policy-status --bucket BUCKET

# Encryption
aws s3api get-bucket-encryption --bucket BUCKET
aws s3api put-bucket-encryption --bucket BUCKET \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

# CORS
aws s3api get-bucket-cors --bucket BUCKET

# Logging
aws s3api get-bucket-logging --bucket BUCKET

# Versioning
aws s3api get-bucket-versioning --bucket BUCKET
```

## Azure Blob Storage

```bash
# List storage accounts
az storage account list --query "[].{Name:name,PublicAccess:allowBlobPublicAccess}" --output table

# Disable public access
az storage account update --name ACCOUNT --resource-group RG --allow-blob-public-access false

# Enable HTTPS only
az storage account update --name ACCOUNT --resource-group RG --https-only true

# List containers with public access
az storage container list --account-name ACCOUNT --query "[?properties.publicAccess!='off']"
```

## GCP Cloud Storage

```bash
# Check IAM for public access
gsutil iam get gs://BUCKET

# Remove public access
gsutil iam ch -d allUsers gs://BUCKET

# Enable uniform bucket-level access
gsutil uniformbucketlevelaccess set on gs://BUCKET

# Check encryption
gsutil kms encryption gs://BUCKET
```

## CIS Benchmark Controls

| Provider | Control | Description |
|----------|---------|-------------|
| AWS | 2.1.1 | S3 bucket policy does not grant public access |
| AWS | 2.1.2 | S3 public access blocks configured |
| AWS | 2.1.4 | S3 server-side encryption enabled |
| Azure | 3.1 | Secure transfer required enabled |
| Azure | 3.7 | Public access level set to private |
| GCP | 5.1 | Uniform bucket-level access enabled |
