<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Continuous Compliance Monitoring — API Reference

## OPA Policy Commands

```bash
# Evaluate policies against input data
opa eval -d policies/ -i config.json "data.compliance.violations"

# Run policy tests
opa test policies/ -v

# Bundle policies for distribution
opa build -b policies/ -o compliance-bundle.tar.gz

# Start OPA as decision service
opa run --server --addr :8181 policies/
```

## AWS Config Commands

```bash
# List all config rules
aws configservice describe-config-rules --query 'ConfigRules[].ConfigRuleName'

# Get compliance by rule
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name <RULE_NAME> --compliance-types NON_COMPLIANT

# Get compliance by resource
aws configservice get-compliance-details-by-resource \
  --resource-type AWS::EC2::Instance --resource-id <INSTANCE_ID>

# Deploy conformance pack
aws configservice put-conformance-pack \
  --conformance-pack-name cis-benchmark \
  --template-body file://cis-conformance-pack.yaml

# Get aggregate compliance
aws configservice get-aggregate-compliance-details-by-config-rule \
  --configuration-aggregator-name org-aggregator \
  --config-rule-name encrypted-volumes \
  --compliance-type NON_COMPLIANT
```

## InSpec Scheduled Execution

```bash
# Run compliance scan with JSON reporter
inspec exec cis-benchmark --reporter json:/var/log/compliance/results.json

# Run against remote target
inspec exec cis-benchmark -t ssh://audit@host --reporter json:-

# Compare two scan results
diff <(jq '.profiles[].controls[].id' scan1.json) \
     <(jq '.profiles[].controls[].id' scan2.json)
```

## Drift Detection Queries

```bash
# Find newly non-compliant resources (AWS Config)
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name encrypted-volumes \
  --compliance-types NON_COMPLIANT \
  --query 'EvaluationResults[?ConfigRuleInvokedTime>`2026-01-01`]'

# Parse InSpec drift from JSON
jq '[.profiles[].controls[] | select(.results[].status == "failed")] |
  map({id: .id, title: .title})' /var/log/compliance/latest.json
```
