# Create an IAM role for Lambda (assume-role trust policy)
aws iam create-role \
  --role-name LambdaDynamoRole \
  --assume-role-policy-document '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Allow",
      "Principal":{"Service":"lambda.amazonaws.com"},
      "Action":"sts:AssumeRole"
    }]
  }'

# Attach an AWS managed policy to the role
aws iam attach-role-policy \
  --role-name LambdaDynamoRole \
  --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess

# Dry-run permission simulation (before deploying)
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/LambdaDynamoRole \
  --action-names dynamodb:GetItem dynamodb:PutItem \
  --query 'EvaluationResults[*].[EvalActionName,EvalDecision]'

# Audit: list all roles and their attached policies
aws iam list-roles \
  --query 'Roles[*].[RoleName,Arn]' \
  --output table

# Find roles with wildcard Action: * (overly permissive)
aws iam list-policies --scope Local \
  --query 'Policies[*].[PolicyName,Arn]' --output text | \
  while read name arn; do
    aws iam get-policy-version --policy-arn "$arn" --version-id v1 \
      --query 'PolicyVersion.Document.Statement[?Action==`*`]' 2>/dev/null
  done

# Create an SCP that denies all non-approved AWS regions
aws organizations create-policy \
  --name "DenyNonApprovedRegions" \
  --type SERVICE_CONTROL_POLICY \
  --description "Restricts all actions to approved regions only" \
  --content '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Deny",
      "Action":"*",
      "Resource":"*",
      "Condition":{
        "StringNotEquals":{
          "aws:RequestedRegion":["us-east-1","eu-west-1"]
        },
        "ArnNotLike":{
          "aws:PrincipalARN":"arn:aws:iam::*:role/BreakGlassRole"
        }
      }
    }]
  }'

# Attach the SCP to an Organizational Unit
aws organizations attach-policy \
  --policy-id p-XXXXXXXX \
  --target-id ou-xxxx-yyyyyyyy

# List all SCPs attached to a target (OU or account)
aws organizations list-policies-for-target \
  --target-id ou-xxxx-yyyyyyyy \
  --filter SERVICE_CONTROL_POLICY \
  --query 'Policies[*].[Name,Id,AwsManaged]'

# Verify effective SCP for a member account
aws organizations describe-effective-policy \
  --policy-type SERVICE_CONTROL_POLICY \
  --target-id 123456789012

# List all configured permission sets
aws sso-admin list-permission-sets \
  --instance-arn arn:aws:sso:::instance/ssoins-xxxxxxxxxxxxxxxx \
  --query 'PermissionSets'

# Assign a permission set to a user in an account
aws sso-admin create-account-assignment \
  --instance-arn arn:aws:sso:::instance/ssoins-xxxxxxxxxxxxxxxx \
  --target-id 123456789012 \
  --target-type AWS_ACCOUNT \
  --permission-set-arn arn:aws:sso:::permissionSet/ssoins-xxx/ps-xxx \
  --principal-type USER \
  --principal-id user-id-from-identity-store

# List all users in the Identity Store
aws identitystore list-users \
  --identity-store-id d-xxxxxxxxxx \
  --query 'Users[*].[UserId,UserName,DisplayName]'

# Login and get short-term credentials (developer workflow)
aws sso login --profile prod-readonly
aws sts get-caller-identity --profile prod-readonly

# Share a Transit Gateway with the entire Organization
aws ram create-resource-share \
  --name "SharedTransitGateway" \
  --resource-arns arn:aws:ec2:us-east-1:123456789012:transit-gateway/tgw-xxx \
  --principals arn:aws:organizations::123456789012:organization/o-xxxxxxxxxx \
  --allow-external-principals false

# List all resources you are sharing (as owner)
aws ram list-resources \
  --resource-owner SELF \
  --query 'resources[*].[arn,type,status,resourceShareArn]'

# List resources shared WITH your account (as consumer)
aws ram list-resources \
  --resource-owner OTHER-ACCOUNTS \
  --query 'resources[*].[arn,type,resourceShareArn]'

# Accept a resource share invitation (member account)
aws ram get-resource-share-invitations \
  --query 'resourceShareInvitations[*].[resourceShareInvitationArn,status]'

aws ram accept-resource-share-invitation \
  --resource-share-invitation-arn arn:aws:ram:us-east-1:123:invitation/xxx

# Create security groups for each tier
aws ec2 create-security-group \
  --group-name alb-sg --vpc-id vpc-xxx \
  --description "Public ALB — HTTPS only"

aws ec2 create-security-group \
  --group-name app-sg --vpc-id vpc-xxx \
  --description "Application tier — from ALB only"

aws ec2 create-security-group \
  --group-name db-sg --vpc-id vpc-xxx \
  --description "Database tier — from App only"

# ALB: allow HTTPS from anywhere
aws ec2 authorize-security-group-ingress \
  --group-id sg-alb --protocol tcp --port 443 --cidr 0.0.0.0/0

# App: allow port 8080 only from ALB security group
aws ec2 authorize-security-group-ingress \
  --group-id sg-app --protocol tcp --port 8080 \
  --source-group sg-alb

# DB: allow port 5432 only from App security group
aws ec2 authorize-security-group-ingress \
  --group-id sg-db --protocol tcp --port 5432 \
  --source-group sg-app

# Security audit: find SGs with unrestricted inbound (0.0.0.0/0)
aws ec2 describe-security-groups \
  --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[*].[GroupId,GroupName,VpcId]' \
  --output table

# Create a NACL in the target VPC
aws ec2 create-network-acl \
  --vpc-id vpc-xxx \
  --tag-specifications 'ResourceType=network-acl,Tags=[{Key=Name,Value=public-nacl}]'

# Rule 50: DENY inbound from a malicious IP range (evaluated first)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-xxx \
  --rule-number 50 \
  --protocol -1 \
  --rule-action deny \
  --ingress \
  --cidr-block 203.0.113.0/24

# Rule 100: ALLOW all other inbound traffic
aws ec2 create-network-acl-entry \
  --network-acl-id acl-xxx \
  --rule-number 100 \
  --protocol -1 \
  --rule-action allow \
  --ingress \
  --cidr-block 0.0.0.0/0

# Rule 100: ALLOW all outbound (stateless — must define both directions)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-xxx \
  --rule-number 100 \
  --protocol -1 \
  --rule-action allow \
  --egress \
  --cidr-block 0.0.0.0/0

# Associate NACL with a subnet
aws ec2 replace-network-acl-association \
  --association-id aclassoc-xxx \
  --network-acl-id acl-xxx

# Create a WAF Web ACL (CloudFront scope — must be in us-east-1)
aws wafv2 create-web-acl \
  --name "EcommerceWebACL" \
  --scope CLOUDFRONT \
  --region us-east-1 \
  --default-action Allow={} \
  --visibility-config \
    SampledRequestsEnabled=true,\
CloudWatchMetricsEnabled=true,\
MetricName=EcommerceWebACL \
  --rules '[
    {
      "Name":"AWSManagedRulesCommonRuleSet",
      "Priority":1,
      "OverrideAction":{"None":{}},
      "Statement":{"ManagedRuleGroupStatement":{
        "VendorName":"AWS","Name":"AWSManagedRulesCommonRuleSet"
      }},
      "VisibilityConfig":{
        "SampledRequestsEnabled":true,
        "CloudWatchMetricsEnabled":true,
        "MetricName":"CommonRuleSet"
      }
    }
  ]'

# Associate WAF Web ACL with an ALB
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:123:regional/webacl/EcommerceWebACL/xxx \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:123:loadbalancer/app/my-alb/xxx

# Sample blocked requests for investigation
aws wafv2 get-sampled-requests \
  --web-acl-arn arn:aws:wafv2:us-east-1:123:regional/webacl/EcommerceWebACL/xxx \
  --rule-metric-name CommonRuleSet \
  --scope REGIONAL \
  --time-window StartTime=$(date -d '-1 hour' +%s),EndTime=$(date +%s) \
  --max-items 50

# Subscribe to Shield Advanced (once per organisation)
aws shield create-subscription

# Protect a specific Application Load Balancer
aws shield create-protection \
  --name "Production ALB" \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:123:loadbalancer/app/prod-alb/xxx

# Protect a CloudFront distribution
aws shield create-protection \
  --name "Production CloudFront" \
  --resource-arn arn:aws:cloudfront::123456789012:distribution/EDFDVBD6EXAMPLE

# List all active DDoS attacks in the last 7 days
aws shield list-attacks \
  --start-time StartTime=$(date -d '-7 days' +%s) \
  --end-time EndTime=$(date +%s) \
  --query 'AttackSummaries[*].[AttackId,StartTime,AttackVectors[0].VectorType]'

# List all Shield-protected resources
aws shield list-protections \
  --query 'Protections[*].[Name,ResourceArn,Id]' \
  --output table

# Create a stateful domain-blocking rule group
aws network-firewall create-rule-group \
  --rule-group-name "BlockMaliciousDomains" \
  --type STATEFUL \
  --capacity 100 \
  --rule-group '{
    "RulesSource":{
      "RulesSourceList":{
        "Targets":["malware.example.com","c2.badactor.net"],
        "TargetTypes":["HTTP_HOST","TLS_SNI"],
        "GeneratedRulesType":"DENYLIST"
      }
    }
  }'

# Create a firewall policy referencing the rule group
aws network-firewall create-firewall-policy \
  --firewall-policy-name "CentralInspectionPolicy" \
  --firewall-policy '{
    "StatelessDefaultActions":["aws:forward_to_sfe"],
    "StatelessFragmentDefaultActions":["aws:forward_to_sfe"],
    "StatefulRuleGroupReferences":[{
      "ResourceArn":"arn:aws:network-firewall:us-east-1:123:stateful-rulegroup/BlockMaliciousDomains"
    }]
  }'

# Deploy the firewall into an inspection subnet
aws network-firewall create-firewall \
  --firewall-name "CentralFirewall" \
  --firewall-policy-arn arn:aws:network-firewall:us-east-1:123:firewall-policy/CentralInspectionPolicy \
  --vpc-id vpc-inspection-xxx \
  --subnet-mappings SubnetId=subnet-inspection-xxx

# Enable Flow Logs for an entire VPC to S3 (all traffic)
aws ec2 create-flow-logs \
  --resource-ids vpc-xxx \
  --resource-type VPC \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::my-vpc-flow-logs-bucket \
  --log-format '${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}'

# Enable REJECT-only logs to CloudWatch Logs (real-time alerts)
aws ec2 create-flow-logs \
  --resource-ids vpc-xxx \
  --resource-type VPC \
  --traffic-type REJECT \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flowlogs/rejected \
  --deliver-logs-permission-arn arn:aws:iam::123456789012:role/FlowLogsDeliveryRole

# Athena query: top 20 rejected source IPs (threat hunting)
# SELECT srcaddr, COUNT(*) AS attempts, SUM(bytes) AS total_bytes
# FROM vpc_flow_logs
# WHERE action = 'REJECT'
#   AND from_unixtime(start) > NOW() - INTERVAL '24' HOUR
# GROUP BY srcaddr
# ORDER BY attempts DESC LIMIT 20;

# List existing flow log configurations
aws ec2 describe-flow-logs \
  --query 'FlowLogs[*].[FlowLogId,ResourceId,TrafficType,LogDestinationType,DeliverLogsStatus]' \
  --output table

# Enable GuardDuty in the current region
aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES \
  --data-sources '{
    "S3Logs":{"Enable":true},
    "Kubernetes":{"AuditLogs":{"Enable":true}},
    "MalwareProtection":{"ScanEc2InstanceWithFindings":{"EbsVolumes":true}}
  }'

# Get the detector ID for all subsequent calls
DETECTOR_ID=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)

# List HIGH and CRITICAL severity findings
aws guardduty list-findings \
  --detector-id $DETECTOR_ID \
  --finding-criteria '{
    "Criterion":{
      "severity":{"Gte":7},
      "service.archived":{"Eq":["false"]}
    }
  }' --output text

# Get detailed information on specific findings
aws guardduty get-findings \
  --detector-id $DETECTOR_ID \
  --finding-ids finding-id-xxx \
  --query 'Findings[0].[Title,Type,Severity,Description,Service.Action]'

# Create a suppression filter (auto-archive known false positives)
aws guardduty create-filter \
  --detector-id $DETECTOR_ID \
  --name "SuppressDevScanners" \
  --action ARCHIVE \
  --finding-criteria '{
    "Criterion":{
      "resource.instanceDetails.tags.value":{"Eq":["security-scanner"]}
    }
  }'

# Enable Security Hub with default security standards
aws securityhub enable-security-hub \
  --enable-default-standards

# Get all CRITICAL unresolved findings
aws securityhub get-findings \
  --filters '{
    "SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}],
    "WorkflowStatus":[{"Value":"NEW","Comparison":"EQUALS"}],
    "RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]
  }' \
  --query 'Findings[*].[Title,ProductName,CreatedAt,AwsAccountId]' \
  --output table

# Mark findings as resolved after remediation
aws securityhub batch-update-findings \
  --finding-identifiers '[{"Id":"finding-id","ProductArn":"arn:aws:securityhub:..."}]' \
  --workflow '{"Status":"RESOLVED"}' \
  --note '{"Text":"Patched in PR #1234","UpdatedBy":"alice@company.com"}'

# Disable a compliance control with a documented justification
aws securityhub update-standards-control \
  --standards-control-arn arn:aws:securityhub:us-east-1:123:control/cis-aws-foundations-benchmark/v/1.2.0/1.16 \
  --control-status DISABLED \
  --disabled-reason "Compensating control enforced via SCP at the Organization level"

# Enable Detective (creates a behaviour graph automatically)
aws detective create-graph \
  --tags '{"Environment":"prod"}'

# List your behaviour graphs
aws detective list-graphs \
  --query 'GraphList[*].[Arn,CreatedTime]'

# Invite member accounts to contribute data to the graph
aws detective create-members \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph/xxx \
  --accounts '[
    {"AccountId":"111122223333","EmailAddress":"sec-ops@subsidiary.com"},
    {"AccountId":"444455556666","EmailAddress":"sec-ops@division.com"}
  ]'

# List all members and their status
aws detective list-members \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph/xxx \
  --query 'MemberDetails[*].[AccountId,Status,UpdatedTime]'

# Create a multi-region, organisation-wide trail
aws cloudtrail create-trail \
  --name "OrgWideAuditTrail" \
  --s3-bucket-name my-cloudtrail-logs-bucket \
  --is-multi-region-trail \
  --is-organization-trail \
  --include-global-service-events \
  --enable-log-file-validation

# Start logging
aws cloudtrail start-logging --name OrgWideAuditTrail

# Look up all S3 DeleteObject events in the last 7 days
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteObject \
  --start-time $(date -d '-7 days' -u +%Y-%m-%dT%H:%M:%SZ) \
  --query 'Events[*].[EventTime,Username,Resources[0].ResourceName,SourceIPAddress]' \
  --output table

# Look up ALL actions from a specific access key (incident response)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAIOSFODNN7EXAMPLE \
  --query 'Events[*].[EventTime,EventName,SourceIPAddress]'

# Verify log file integrity (detect tampering)
aws cloudtrail validate-logs \
  --trail-arn arn:aws:cloudtrail:us-east-1:123:trail/OrgWideAuditTrail \
  --start-time 2024-01-01T00:00:00Z

# Enable Inspector across EC2, ECR, and Lambda
aws inspector2 enable \
  --resource-types EC2 ECR LAMBDA

# Get all active findings sorted by severity
aws inspector2 list-findings \
  --filter-criteria '{
    "findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]
  }' \
  --sort-criteria '{"field":"SEVERITY","sortOrder":"DESC"}' \
  --query 'findings[*].[severity,title,packageVulnerabilityDetails.vulnerabilityId,resources[0].id]' \
  --output table

# Get critical findings for ECR container images only
aws inspector2 list-findings \
  --filter-criteria '{
    "severity":[{"comparison":"EQUALS","value":"CRITICAL"}],
    "resourceType":[{"comparison":"EQUALS","value":"AWS_ECR_CONTAINER_IMAGE"}]
  }' \
  --query 'findings[*].[title,packageVulnerabilityDetails.cvss[0].baseScore]'

# Create a suppression filter for a known false positive
aws inspector2 create-filter \
  --name "SuppressBaseOSFalsePositive" \
  --action SUPPRESS \
  --filter-criteria '{
    "vulnerabilityId":[{"comparison":"EQUALS","value":"CVE-2022-XXXXX"}]
  }'

# Create a symmetric customer-managed KMS key with a restrictive key policy
aws kms create-key \
  --description "PHI S3 Encryption Key — prod" \
  --key-usage ENCRYPT_DECRYPT \
  --key-spec SYMMETRIC_DEFAULT \
  --policy '{
    "Version":"2012-10-17",
    "Statement":[
      {
        "Effect":"Allow",
        "Principal":{"AWS":"arn:aws:iam::123456789012:root"},
        "Action":"kms:*","Resource":"*"
      },
      {
        "Effect":"Allow",
        "Principal":{"AWS":"arn:aws:iam::123456789012:role/DataProcessingRole"},
        "Action":["kms:Decrypt","kms:GenerateDataKey"],
        "Resource":"*"
      }
    ]
  }'

# Create a human-readable alias
aws kms create-alias \
  --alias-name alias/phi-s3-prod \
  --target-key-id key-id-from-above

# Enable automatic annual key rotation
aws kms enable-key-rotation --key-id alias/phi-s3-prod

# Generate a data key (envelope encryption pattern)
aws kms generate-data-key \
  --key-id alias/phi-s3-prod \
  --key-spec AES_256 \
  --query '[CiphertextBlob,Plaintext]' --output text

# Audit: all KMS API calls for this key (via CloudTrail)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=alias/phi-s3-prod \
  --query 'Events[*].[EventTime,EventName,Username]' --output table

# Enable Macie in the current account
aws macie2 enable-macie

# Create a sensitive data discovery job for specific buckets
aws macie2 create-classification-job \
  --job-type ONE_TIME \
  --name "Q1-2024-PII-Scan" \
  --s3-job-definition '{
    "bucketDefinitions":[{
      "accountId":"123456789012",
      "buckets":["prod-customer-data","staging-uploads","data-lake-raw"]
    }]
  }' \
  --managed-data-identifier-selector ALL

# List active HIGH and CRITICAL findings
aws macie2 list-findings \
  --finding-criteria '{
    "criterion":{
      "severity.description":{"eq":["High","Critical"]},
      "classificationDetails.result.sensitiveData.category":{
        "eq":["FINANCIAL_INFORMATION","PERSONAL_INFORMATION","CREDENTIALS"]
      }
    }
  }' \
  --query 'findingIds'

# Check S3 bucket posture — find publicly accessible buckets
aws macie2 describe-buckets \
  --criteria '{
    "publicAccess.effectivePermission":{"eq":["PUBLIC"]}
  }' \
  --query 'buckets[*].[bucketName,publicAccess.effectivePermission,serverSideEncryption.type]'

# Store a structured database credential secret
aws secretsmanager create-secret \
  --name "prod/myapp/postgres-credentials" \
  --description "Production PostgreSQL credentials" \
  --kms-key-id alias/phi-s3-prod \
  --secret-string '{
    "username":"app_user",
    "password":"InitialP@ss!",
    "host":"db.prod.internal",
    "port":5432,
    "dbname":"appdb"
  }'

# Enable automatic 30-day rotation using the AWS-managed RDS rotator
aws secretsmanager rotate-secret \
  --secret-id prod/myapp/postgres-credentials \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123:function:SecretsManagerPostgreSQLRotation \
  --rotation-rules '{"AutomaticallyAfterDays":30}'

# Retrieve and decode the current secret value
aws secretsmanager get-secret-value \
  --secret-id prod/myapp/postgres-credentials \
  --query SecretString --output text | python3 -m json.tool

# Application code — retrieve secret at runtime (Python Boto3):
# import boto3, json
# secret = json.loads(
#   boto3.client('secretsmanager')
#     .get_secret_value(SecretId='prod/myapp/postgres-credentials')['SecretString']
# )
# conn = psycopg2.connect(**secret)

# Store a plaintext config parameter
aws ssm put-parameter \
  --name /prod/myapp/DB_HOST \
  --value "db.prod.internal.example.com" \
  --type String

# Store an encrypted secret (KMS SecureString)
aws ssm put-parameter \
  --name /prod/myapp/DB_PASSWORD \
  --value "S3cur3P@ssw0rd!" \
  --type SecureString \
  --key-id alias/phi-s3-prod \
  --overwrite

# Retrieve all parameters under a path hierarchy (with decryption)
aws ssm get-parameters-by-path \
  --path /prod/myapp/ \
  --with-decryption \
  --recursive \
  --query 'Parameters[*].[Name,Value,Type]' \
  --output table

# Reference in CloudFormation / CDK (dynamic resolution, no hardcoding):
# DB_PASSWORD: !Sub '{{resolve:ssm-secure:/prod/myapp/DB_PASSWORD:1}}'
# DB_HOST:     !Sub '{{resolve:ssm:/prod/myapp/DB_HOST:1}}'

# Retrieve in a Lambda function (Python Boto3):
# ssm = boto3.client('ssm')
# password = ssm.get_parameter(
#   Name='/prod/myapp/DB_PASSWORD', WithDecryption=True
# )['Parameter']['Value']

# Request a public certificate with DNS validation
aws acm request-certificate \
  --domain-name "example.com" \
  --subject-alternative-names "*.example.com" "api.example.com" \
  --validation-method DNS \
  --tags '[{"Key":"Environment","Value":"prod"}]'

# List all certificates and their renewal eligibility
aws acm list-certificates \
  --certificate-statuses ISSUED \
  --query 'CertificateSummaryList[*].[DomainName,CertificateArn,RenewalEligibility]' \
  --output table

# Inspect a certificate's expiry date and renewal status
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123:certificate/xxx \
  --query 'Certificate.[DomainName,NotAfter,Status,RenewalSummary.RenewalStatus]'

# Import an externally issued certificate (e.g., from a private CA)
aws acm import-certificate \
  --certificate fileb://fullchain.pem \
  --private-key fileb://privkey.pem \
  --certificate-chain fileb://chain.pem

# Set up a CloudWatch alarm for certificates expiring within 30 days
aws cloudwatch put-metric-alarm \
  --alarm-name "ACM-CertExpiry-30Days" \
  --namespace AWS/CertificateManager \
  --metric-name DaysToExpiry \
  --statistic Minimum \
  --period 86400 \
  --threshold 30 \
  --comparison-operator LessThanThreshold \
  --alarm-actions arn:aws:sns:us-east-1:123:CertExpiryAlerts

# Create a User Pool with strong security defaults
aws cognito-idp create-user-pool \
  --pool-name "MyAppUserPool" \
  --policies '{
    "PasswordPolicy":{
      "MinimumLength":14,
      "RequireUppercase":true,
      "RequireNumbers":true,
      "RequireSymbols":true,
      "TemporaryPasswordValidityDays":1
    }
  }' \
  --mfa-configuration ON \
  --auto-verified-attributes email

# Enforce software TOTP MFA for all users
aws cognito-idp set-user-pool-mfa-config \
  --user-pool-id us-east-1_xxxxxxxxx \
  --software-token-mfa-configuration Enabled=true \
  --mfa-configuration ON

# Create an App Client for a React SPA (no client secret — public client)
aws cognito-idp create-user-pool-client \
  --user-pool-id us-east-1_xxxxxxxxx \
  --client-name "ReactSPAClient" \
  --no-generate-secret \
  --explicit-auth-flows ALLOW_USER_SRP_AUTH ALLOW_REFRESH_TOKEN_AUTH \
  --prevent-user-existence-errors ENABLED

# Immediately disable a compromised user account
aws cognito-idp admin-disable-user \
  --user-pool-id us-east-1_xxxxxxxxx \
  --username alice@example.com

# Revoke all active sessions for a user (force re-authentication)
aws cognito-idp admin-user-global-sign-out \
  --user-pool-id us-east-1_xxxxxxxxx \
  --username alice@example.com

# Enable Config recording for all supported resource types
aws configservice put-configuration-recorder \
  --configuration-recorder '{
    "name":"default",
    "roleARN":"arn:aws:iam::123456789012:role/ConfigRecorderRole",
    "recordingGroup":{
      "allSupported":true,
      "includeGlobalResourceTypes":true
    }
  }'

# Set delivery channel (S3 + SNS on every change)
aws configservice put-delivery-channel \
  --delivery-channel '{
    "name":"default",
    "s3BucketName":"my-config-snapshots-bucket",
    "snsTopicARN":"arn:aws:sns:us-east-1:123:config-changes",
    "configSnapshotDeliveryProperties":{"deliveryFrequency":"TwentyFour_Hours"}
  }'

# Start the recorder
aws configservice start-configuration-recorder \
  --configuration-recorder-name default

# Add a managed rule: S3 public read must be prohibited
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName":"s3-bucket-public-read-prohibited",
    "Source":{
      "Owner":"AWS",
      "SourceIdentifier":"S3_BUCKET_PUBLIC_READ_PROHIBITED"
    }
  }'

# List all non-compliant S3 buckets right now
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name s3-bucket-public-read-prohibited \
  --compliance-types NON_COMPLIANT \
  --query 'EvaluationResults[*].[EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,ResultRecordedTime]' \
  --output table

# Set up automatic remediation (re-enable block public access)
aws configservice put-remediation-configurations \
  --remediation-configurations '[{
    "ConfigRuleName":"s3-bucket-public-read-prohibited",
    "TargetType":"SSM_DOCUMENT",
    "TargetId":"AWS-DisableS3BucketPublicReadWrite",
    "Automatic":true,
    "MaximumAutomaticAttempts":3,
    "RetryAttemptSeconds":60
  }]'

# List available standard audit frameworks
aws auditmanager list-assessment-frameworks \
  --framework-type Standard \
  --query 'frameworkMetadataList[*].[name,id,complianceType]' \
  --output table

# Get the framework ID for SOC 2
SOC2_ID=$(aws auditmanager list-assessment-frameworks \
  --framework-type Standard \
  --query 'frameworkMetadataList[?name==`SOC 2`].id' \
  --output text)

# Create a SOC 2 Type II assessment
aws auditmanager create-assessment \
  --name "SOC2-Type2-FY2024" \
  --description "Annual SOC 2 Type II assessment for FY2024" \
  --assessment-reports-destination \
    'destinationType=S3,destination=s3://my-audit-evidence-bucket' \
  --scope '{
    "awsAccounts":[{"id":"123456789012","emailAddress":"audit@company.com","name":"Main Account"}],
    "awsServices":[
      {"serviceName":"S3"},{"serviceName":"IAM"},
      {"serviceName":"CloudTrail"},{"serviceName":"Config"}
    ]
  }' \
  --framework-id $SOC2_ID \
  --roles '[{"roleArn":"arn:aws:iam::123456789012:role/AuditManagerRole","roleType":"PROCESS_OWNER"}]'

# List assessments and their current status
aws auditmanager list-assessments \
  --query 'assessmentMetadataList[*].[name,status,lastUpdated,complianceType]' \
  --output table

# Generate a final assessment report for auditors
aws auditmanager create-assessment-report \
  --name "SOC2-FY2024-Final-Report" \
  --assessment-id assessment-id-xxx