enforcer

A utility for auditing and remediating AWS S3 Public Access Block configurations.

• Getting Started
• Usage
• Commands
• Testing and Development
• Design

Getting Started

Enforcer uses the AWS Javascript SDK internally and assumes all users of the tool have configured CLI and/or API access to AWS. If you don't have a locally configured AWS profile, configure one before using this tool: Configuration and credential file settings in the AWS CLI

Enforcer is otherwise self-contained and only requires connectivity to AWS APIs to function.

Installation

You may install Enforcer with your preferred package manager or use pnpm dlx to run Enforcer without persisting the tool to your system.

npm

$ npm install -g @absurd-engineering/enforcer
$ enforcer help

pnpm

$ pnpm dlx @absurd-engineering/enforcer help

Usage

$ npm install -g @absurd-engineering/enforcer
$ enforcer COMMAND
running command...
$ enforcer (--version)
@absurd-engineering/enforcer/0.0.3 linux-x64 node-v24.5.0
$ enforcer --help [COMMAND]
USAGE
  $ enforcer COMMAND
...

Commands

• enforcer audit
• enforcer help [COMMAND]

enforcer audit

Audit AWS S3 public access blocks

USAGE
  $ enforcer audit --profile <value> [--json] [--bucket <value>] [--fix]

AUDIT FLAGS
  --bucket=<value>  Scope actions to a specific bucket
  --fix             Overwrite public access blocks to disallow public access

GLOBAL FLAGS
  --json             Format output as json.
  --profile=<value>  (required) AWS profile to use for authentication against AWS

DESCRIPTION
  Audit AWS S3 public access blocks

EXAMPLES
  $ enforcer audit --profile default

  $ enforcer audit --bucket my-bucket --profile default

  $ enforcer audit --fix --profile default

FLAG DESCRIPTIONS
  --bucket=<value>  Scope actions to a specific bucket

    If not provided, actions will be scoped to all buckets

  --fix  Overwrite public access blocks to disallow public access

    Update public access blocks for all buckets to disallow public access.
    See: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html#access-control-bl
    ock-public-access-options

  --profile=<value>  AWS profile to use for authentication against AWS

    See https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html#cli-configure-files-using-profiles

See code: src/commands/audit.ts

enforcer help [COMMAND]

Display help for enforcer.

USAGE
  $ enforcer help [COMMAND...] [-n]

ARGUMENTS
  COMMAND...  Command to show help for.

FLAGS
  -n, --nested-commands  Include all nested commands in the output.

DESCRIPTION
  Display help for enforcer.

See code: @oclif/plugin-help

Testing and Development

To test or contribute to this project:

1. Install fnm or your preferred Node version manager
2. Install and use the version of NodeJS documented in .node-version
3. Install pnpm
   • Optionally, you may install pnpm using Corepack if available in your environment
4. Run pnpm install from the root of this project directory
5. Run pnpm test to execute unit tests

Running a development build

Enforcer uses the excellent oclif CLI framework to provide basic functionality for this tool. oclif provides multiple entry points to Enforcer at bin/dev and bin/run:

• node bin/dev.js will execute local code from this project
• node bin/run.js will execute the results of pnpm build stored in the ./dist directory

You can use both of these entry points to manually test or experiment with the Enforcer CLI as needed.

Design

See DESIGN.md