awscli

Overview ¶

Package awscli implements remediate.Strategy renderers for the FormatAWSCLI output. Each strategy emits an `aws <service> ...` one-liner (or short multi-step script) that flips the bad-state finding to good-state via the AWS public API.

Strategies pair with internal/remediate/terraform/aws.go: the same CheckIDs are covered in both packages so an operator picks the format that matches their workflow. Terraform is the right answer when the resource is managed in code; aws-cli is the right answer for live-cloud-only resources or for the immediate-fix step before code lands.

Convention for the emitted Content:

• Single-line where possible. Long commands wrap with `\` so the runbook stays readable.
• Every value the operator's shell would interpret runs through render.ShellQuote — bucket names, ARNs, regions, and so on.
• VerifyCmd is always populated: same service, *describe-* or *get-* variant, projecting just the single field the fix touched. The operator can run verify immediately after apply.
• RollbackCmd is populated when the inverse command is trivially expressible (set-acl private → set-acl public-read), empty when it would require multi-step or destructive operations.