> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fjall.io/llms.txt
> Use this file to discover all available pages before exploring further.
# fjall compliance
> Inspect AWS compliance findings with the Fjall CLI and run a gated remediation for a single issue from your terminal.
`fjall compliance` reads remediation context from the Fjall control plane and runs the cure for one compliance issue.
The command has a single subcommand, `fix`. Everything it does routes through the Fjall API, so it never talks to AWS directly from your machine.
* **Fjall CLI installed and authenticated.** Run `fjall login`, or set `FJALL_API_KEY` in CI. An unauthenticated invocation fails before any request goes out.
* **A connected AWS account that Fjall has scanned.** Compliance issues are recorded when a discovery scan of a connected account completes, so `fjall connect` comes first.
* **A Pro or Enterprise plan for `--execute`.** Remediation returns `403 Compliance remediation requires a Pro or Enterprise plan.` on other plans. Reading context has no plan gate.
* **Admin rights for the privileged cure.** The bucket unlock path needs an admin-scoped token or an admin/owner session. A legacy `fj_` organisation token is rejected outright.
## Read remediation context
```bash theme={null}
fjall compliance fix --domain
```
```bash theme={null}
# Open issues, their IDs, and related security insights
fjall compliance fix --domain compliance
# Scope the context to one application
fjall compliance fix --domain compliance --app api
# Targeted context for one issue
fjall compliance fix --domain compliance --issue-id cmpi_7f3a91c4
```
`--domain` takes one of three values. Any other value is rejected with `400 Invalid query parameters`.
`fjall compliance --help` describes this flag as "Compliance domain (e.g. SOC2, HIPAA)". Those examples are not accepted values. The API takes `compliance`, `cost` or `performance` only, and anything else returns `400 Invalid query parameters`.
| Domain | What comes back |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `compliance` | `topIssues` (up to 10 critical or high issues drawn from the 20 highest-severity open issues), `insights` (security insights), and `targetIssue` when you pass `--issue-id` |
| `cost` | `costAttribution` rows (service, spend, request count, cost per 1k) and cost insights |
| `performance` | Latest per-application metrics with their threshold breaches, plus performance insights |
Issue IDs come from the `compliance` domain response. Read one, then feed it back through `--issue-id`.
## Run a remediation
```bash theme={null}
fjall compliance fix --issue-id --execute --acknowledge-root-session
```
```bash theme={null}
fjall compliance fix --issue-id cmpi_7f3a91c4 --execute --acknowledge-root-session
```
Both flags are mandatory on this path. `--execute` without `--acknowledge-root-session` prints a refusal that names the issue and repeats the full command, then exits `1`. No request reaches the API.
The bucket-quarantine cure deletes the bucket's **entire** policy, including `enforceSSL` denies and legitimate access grants, and it can run a root session (an STS AssumeRoot credential) in the connected account. That is what `--acknowledge-root-session` acknowledges. Capture the current policy before you run it.
`--execute` is honoured only under `fix`. `--domain` is not needed on this path.
## What Happens
**Reading context.** The CLI calls `GET /api/compliance/suggestions` with your `domain`, `applicationId`, and `issueId`, then prints the JSON response with credential values masked. The endpoint is rate-limited to 30 requests per minute per organisation.
**Running a cure.** The CLI calls `POST /api/compliance/{issueId}/remediate`. Fjall selects a strategy from the issue's rule ID and returns one of three shapes:
| Strategy | What it does | Response fields |
| ------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `auto-pr` | Edits the application's infrastructure config and opens a GitHub pull request | `prUrl`, `prNumber`, `branch`, `pendingChangeId` |
| `imperative` | Privileged unlock and restore against the live resource, then a reconcile | `restored`, `enforceSslSynthesised`, `reconcileOutcome`, `reconcileQueued`, `capturedPolicy`, `warning` |
| `manual-hint` | Returns operator guidance, changes nothing | `message`, `awsCliHint` |
Only `open` issues remediate. An issue already cured returns `A cure has already been applied to this issue and is awaiting verification by the next scan.` Any other status is refused by name.
Remediation is bounded at 30 seconds and rate-limited to 5 requests per 5 minutes per organisation. A timeout returns `500 Remediation timed out`.
**Agent mode.** `--agent` renders results and errors as agent blocks instead of JSON. A missing acknowledgement becomes an `action_required` block with action `root_session_acknowledgement_required`, which an agent resolves by re-running with the flag.
**Exit codes.** `0` on success. `1` for usage errors, the acknowledgement refusal, and API failures. A bare `fjall compliance` prints usage and exits `1`. An unrecognised subcommand prints `Available subcommands: fix`.
## Options
| Flag | Description | Default |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------- | ---------------- |
| `--domain ` | Context domain: `compliance`, `cost`, or `performance`. Required by `fix` unless `--execute` is passed | none |
| `-a, --app ` | Filter by application. Sent as the `applicationId` query parameter | all applications |
| `--issue-id ` | Fetch targeted context for one issue, or name the issue to remediate with `--execute` | none |
| `--execute` | Run the remediation for `--issue-id`. Opens a PR, or unlocks a quarantined bucket with an admin-scoped token | off |
| `--acknowledge-root-session` | Acknowledge that `--execute` may run a root session and rewrite a live resource policy. Required by `--execute` | off |
| `--non-interactive` | Force plain CLI output (no UI) | off |
| `-v, --verbose` | Enable verbose output | off |
| `--agent` | Enable agent output mode | auto-detected |
| `--budget ` | Output budget: minimal, compact, or token count | none |
| `--fields ` | Select exactly these output fields | all fields |
| `--full` | Disable content truncation | off |
`--no-agent` is a root option and forces plain output even where agent mode is auto-detected.
## Next Steps
Detect AWS resources changed outside CloudFormation and repair the stacks they wedge.
Mint the admin-scoped token the privileged bucket cure requires.
Structured output, budgets, and the action-required blocks agents act on.
Approval gates and destruction consent on the deploy path.