Run an AWS security scan and return a summary.

Scans your AWS account for security misconfigurations, detects attack chains, and estimates breach cost risk.

Args: profile: AWS CLI profile name (default: "default") regions: Comma-separated AWS regions to scan (default: profile region) min_severity: Minimum finding severity: critical, high, medium, low

Get findings from the last scan, optionally filtered.

Each finding includes check ID, severity, resource, description, and estimated breach cost.

Args: severity: Filter by severity (critical, high, medium, low) service: Filter by AWS service prefix (e.g. "iam", "s3", "ec2", "vpc") limit: Maximum number of findings to return (default: 20)

Get all detected attack chains from the last scan.

Attack chains are correlated findings that form exploitable attack paths. Each chain includes a narrative, priority fix, and breach cost estimate.

Get remediation details (CLI command + Terraform code) for a specific check.

Returns copy-paste ready AWS CLI command and Terraform HCL snippet to fix the finding.

Args: check_id: The check ID (e.g. "aws-iam-001", "aws-s3-001", "aws-vpc-002")

Get the current health score and risk exposure summary.

Returns the 0-100 health score, finding counts by severity, attack chain count, and total estimated risk exposure in USD.

List all available security checks (no AWS credentials needed).

Returns check IDs with their categories and services.