Skip to content

Security Commands

Collect security findings from WAF, GuardDuty, and Security Hub, and manage ACM certificates.

metrics aggregates findings across the three services into one view. create-certificate issues an ACM certificate and writes the Route53 validation records for you, which removes the usual manual copy-paste step.

Commands

security create-certificate

Create an ACM certificate with Route53 DNS validation.

aws-cloud-utilities security create-certificate DOMAIN [OPTIONS]
Option Value Description
--alt-names TEXT Comma-separated list of alternative domain names
--hosted-zone-id TEXT Route53 hosted zone ID for validation (auto-detected if not provided)
--region TEXT AWS region for certificate (default: us-east-1 for CloudFront)
--wait-for-validation flag Wait for certificate validation to complete
--timeout INTEGER Timeout in seconds for validation wait (default: 300)

security list-certificates

List ACM certificates with details.

aws-cloud-utilities security list-certificates [OPTIONS]
Option Value Description
--region TEXT AWS region to list certificates from (default: current region)
--status PENDING_VALIDATION | ISSUED | INACTIVE | EXPIRED | VALIDATION_TIMED_OUT | REVOKED | FAILED Filter certificates by status
--all-regions flag List certificates from all regions

security metrics

Collect security metrics from AWS WAF, GuardDuty, and Security Hub.

aws-cloud-utilities security metrics [OPTIONS]
Option Value Description
--region TEXT AWS region to collect metrics from (default: current region)
--time-range INTEGER Time range in hours for metrics collection (default: 24)
--services TEXT Comma-separated list of services to include (waf,guardduty,securityhub)
--output-file TEXT Output file for security metrics (supports .json, .yaml, .csv)
--all-regions flag Collect metrics from all regions

Examples

# Findings from WAF, GuardDuty, and Security Hub over the last 24 hours
aws-cloud-utilities security metrics

# Last week, one service, every region
aws-cloud-utilities security metrics --time-range 168 --services guardduty --all-regions

# Save the report
aws-cloud-utilities security metrics --services waf,guardduty,securityhub --output-file security.json

# Certificates
aws-cloud-utilities security list-certificates
aws-cloud-utilities security list-certificates --all-regions --status EXPIRED

# Issue a certificate with Route53 DNS validation
aws-cloud-utilities security create-certificate example.com \
    --alt-names www.example.com,api.example.com \
    --wait-for-validation

# Pin the hosted zone and extend the validation timeout
aws-cloud-utilities security create-certificate example.com \
    --hosted-zone-id Z1234567890ABC --timeout 600

Certificate region matters

create-certificate defaults to us-east-1 because CloudFront only accepts certificates from that region. For an ALB or API Gateway certificate, pass the region the load balancer lives in:

aws-cloud-utilities security create-certificate example.com --region eu-west-1

Validation records are written to Route53 automatically; the hosted zone is auto-detected unless you pass --hosted-zone-id. --wait-for-validation blocks until ACM issues the certificate or --timeout seconds elapse.

Notes

metrics only reports on services that are enabled. If GuardDuty is off in a region, that region contributes nothing rather than erroring.

--services is a comma-separated subset of waf, guardduty, securityhub.