Skip to main content
fjall compliance reads remediation context from the Fjall control plane and runs the cure for one compliance issue. The command has a single subcommand, fix. Everything it does routes through the Fjall API, so it never talks to AWS directly from your machine.
  • Fjall CLI installed and authenticated. Run fjall login, or set FJALL_API_KEY in CI. An unauthenticated invocation fails before any request goes out.
  • A connected AWS account that Fjall has scanned. Compliance issues are recorded when a discovery scan of a connected account completes, so fjall connect comes first.
  • A Pro or Enterprise plan for --execute. Remediation returns 403 Compliance remediation requires a Pro or Enterprise plan. on other plans. Reading context has no plan gate.
  • Admin rights for the privileged cure. The bucket unlock path needs an admin-scoped token or an admin/owner session. A legacy fj_ organisation token is rejected outright.

​
Read remediation context

--domain takes one of three values. Any other value is rejected with 400 Invalid query parameters.
fjall compliance --help describes this flag as “Compliance domain (e.g. SOC2, HIPAA)”. Those examples are not accepted values. The API takes compliance, cost or performance only, and anything else returns 400 Invalid query parameters.
Issue IDs come from the compliance domain response. Read one, then feed it back through --issue-id.

​
Run a remediation

Both flags are mandatory on this path. --execute without --acknowledge-root-session prints a refusal that names the issue and repeats the full command, then exits 1. No request reaches the API.
The bucket-quarantine cure deletes the bucket’s entire policy, including enforceSSL denies and legitimate access grants, and it can run a root session (an STS AssumeRoot credential) in the connected account. That is what --acknowledge-root-session acknowledges. Capture the current policy before you run it.
--execute is honoured only under fix. --domain is not needed on this path.

​
What Happens

Reading context. The CLI calls GET /api/compliance/suggestions with your domain, applicationId, and issueId, then prints the JSON response with credential values masked. The endpoint is rate-limited to 30 requests per minute per organisation. Running a cure. The CLI calls POST /api/compliance/{issueId}/remediate. Fjall selects a strategy from the issue’s rule ID and returns one of three shapes: Only open issues remediate. An issue already cured returns A cure has already been applied to this issue and is awaiting verification by the next scan. Any other status is refused by name. Remediation is bounded at 30 seconds and rate-limited to 5 requests per 5 minutes per organisation. A timeout returns 500 Remediation timed out. Agent mode. --agent renders results and errors as agent blocks instead of JSON. A missing acknowledgement becomes an action_required block with action root_session_acknowledgement_required, which an agent resolves by re-running with the flag. Exit codes. 0 on success. 1 for usage errors, the acknowledgement refusal, and API failures. A bare fjall compliance prints usage and exits 1. An unrecognised subcommand prints Available subcommands: fix.

​
Options

--no-agent is a root option and forces plain output even where agent mode is auto-detected.

​
Next Steps

fjall drift

Detect AWS resources changed outside CloudFormation and repair the stacks they wedge.

fjall token

Mint the admin-scoped token the privileged bucket cure requires.

Agent Mode

Structured output, budgets, and the action-required blocks agents act on.

Deployment Safety

Approval gates and destruction consent on the deploy path.