Assure: An Open-Source CLI for APRA Compliance Reports on AWS

A while back I wrote about turning AWS security findings into APRA-paragraph narrative with Bedrock. That was a proof of concept. This is the tool.

assure is an open-source CLI: point it at an AWS account (or a Prowler findings file) and it produces a board-ready, APRA-paragraph-mapped compliance report — for CPS 234 and CPS 230 — as Markdown and a branded PDF. It runs entirely in your own environment: your AWS credentials, your Bedrock, nothing leaves your account.

pipx install aiopsone-assure
assure scan --framework cps234 --region ap-southeast-2

Practitioner tooling, not a substitute for your own assessment or legal advice.

The gap it closes

Run Prowler or Security Hub and you get hundreds of findings. They're accurate, technical, and unreadable to a risk committee. iam_user_administrator_access_policy: FAIL is a fact — it is not a sentence anyone on a board wants to read.

The hard part of an APRA review was never finding the issues. It's translating "IAM user has AdministratorAccess attached" into "Here is our position against CPS 234 paragraph 21, the evidence, the risk, and the priority remediation." That translation is manual, slow, and the single biggest time-sink in a compliance cycle. assure does exactly that step.

How it works

 AWS account / existing findings
        │  (your own AWS creds — nothing leaves your environment)
        ▼
   assure ── run Prowler (scoped to the framework's checks)
        │
        ├─ map each check → CPS 234/230 paragraph
        ├─ narrate: deterministic template, or Amazon Bedrock (AU-resident)
        ▼
   Board-ready report: Markdown + branded PDF

Four moving parts, three of which are the interesting ones:

1. It owns the mapping. assure maps each Prowler check to the CPS 234/230 paragraph it evidences — and it does that mapping itself, from the framework definition, rather than depending on the framework being installed inside your Prowler. Run a normal scan; the tool does the paragraph rollup.

2. It's honest about what AWS can't show. Roughly a third of CPS 234 — board accountability, the policy framework, the notification process — isn't observable from any AWS API. Those controls are marked Manual, not faked green. An automated 60% with eight honestly-flagged manual obligations is a far more useful artifact than a fabricated 100%.

3. Two narrative engines. The default is a deterministic template — offline, free, no AWS calls, perfect for CI and air-gapped reviews. Opt into --engine bedrock and each failing control is narrated by Claude on Amazon Bedrock, running on an Australian-resident inference profile so regulated data never leaves the country. The AI only narrates controls with real finding data; manual controls stay deterministic (the model shouldn't invent a verdict for something it can't assess).

The output of either: an executive summary with an automated compliance score, a control-by-control assessment mapped to paragraphs with cited evidence, and a remediation roadmap.

A worked example

# Run Prowler against an account and build the report in one step
assure scan --framework cps234 --region ap-southeast-2 --engine bedrock

# Or build from findings you already have (Prowler CSV / JSON / OCSF)
assure report --in findings.csv --framework cps234

# Deterministic, no AI, no AWS calls
assure report --in findings.csv --no-ai

# CI gate: non-zero exit if any control FAILs; machine-readable summary
assure report --in findings.csv --json

A typical first run against an un-hardened account lands around 10–25% automated compliance, with the failures you'd expect — an IAM user with AdministratorAccess, no MFA on the root account, CloudTrail not multi-region, no backup vaults — each rendered as a paragraph a risk committee can actually read, against the CPS 234 control it maps to.

Frameworks are just data

A "framework" in assure is a pack: a JSON file mapping checks to paragraphs, plus the narrative context. CPS 234 (20 controls) and CPS 230 (18) ship bundled; point --framework path/to/pack.json at your own. That's deliberate — the same engine that narrates CPS 234 will narrate Essential Eight, the ACSC ISM, or any standard you can express as a mapping. The Australian frameworks are the starting point, not the ceiling.

Why a CLI first

Because the useful, defensible part — the paragraph mapping and the AU-resident narrative — works just as well on your laptop as in a hosted service. The CLI is free and open source: run it yourself, forever, in your own account. It's also the honest way to build — ship the thing that does the work, in the open, before wrapping it in anything fancier.

If you want to understand why a finding like "AdministratorAccess attached" fails the control in the first place, the IAM evaluation logic post walks the six layers. And for the evidence side — what an auditor actually wants to see — there's the auditor-evidence guide.

Try it

pipx install aiopsone-assure
assure frameworks
assure report --in your-prowler-findings.csv --framework cps234 --no-ai

It's MIT-licensed and on GitHub: github.com/jaybilgaye/aiopsone-assure. Issues and framework-pack contributions welcome.

Practitioner guides on AWS Security for APRA-regulated Australia at aiopsone.com.

Primary sources: APRA CPS 234 · APRA CPS 230 · Prowler · Amazon Bedrock