<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Security Posture Management — API Reference

## AWS Config Rules

```python
import boto3

config = boto3.client("config")

# Get compliance by config rule
resp = config.get_compliance_details_by_config_rule(
    ConfigRuleName="s3-bucket-public-read-prohibited",
    ComplianceTypes=["NON_COMPLIANT"],
)

# Evaluate rules on demand
config.start_config_rules_evaluation(ConfigRuleNames=["s3-bucket-ssl-requests-only"])
```

## AWS Security Hub

```python
securityhub = boto3.client("securityhub")

# Get findings by severity
findings = securityhub.get_findings(Filters={
    "SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}],
    "WorkflowStatus": [{"Value": "NEW", "Comparison": "EQUALS"}],
})
```

## Prowler CLI (CIS Benchmarks)

```bash
# Run full CIS assessment
prowler aws --compliance cis_2.0_aws -M json -o results/

# Specific checks only
prowler aws --checks s3_bucket_public_access iam_root_mfa_enabled

# Generate HTML report
prowler aws --compliance cis_2.0_aws -M html
```

## ScoutSuite Multi-Cloud

```bash
# AWS assessment
scout aws --report-dir /tmp/scout-report

# GCP assessment
scout gcp --user-account --report-dir /tmp/scout-gcp
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Posture grade A — all checks passed |
| 1 | Misconfigurations detected — review failures |
| 2 | Assessment execution failure |
