Open-source AWS cost policy engineCI + live AWS

Catch bad AWS spending before it ships.

Install from GitHubRead the docs

CloudBurn runs deterministic cost rules against Terraform and CloudFormation in CI, then runs those same rules against live AWS with discover. Install the open-source CLI with brew or npm and give your team cost visibility on AWS.

  • Terraform + CloudFormation
  • CI + discovery
  • Open-source CLI
❯ cloudburn rules list
RuleId
Provider
Service
Supports
Name
CLDBRN-AWS-CLOUDTRAIL-1
aws
cloudtrail
discovery
CloudTrail Redundant Global Trails
CLDBRN-AWS-CLOUDWATCH-1
aws
cloudwatch
discovery
CloudWatch Log Group Missing Retention
CLDBRN-AWS-EBS-1
aws
ebs
discovery, iac
EBS Volume Type Not Current Generation
CLDBRN-AWS-EC2-1
aws
ec2
iac, discovery
EC2 Instance Type Not Preferred
CLDBRN-AWS-ECR-1
aws
ecr
iac, discovery
ECR Repository Missing Lifecycle Policy
CLDBRN-AWS-EKS-1
aws
eks
discovery
EKS Node Group Without Graviton
CLDBRN-AWS-RDS-1
aws
rds
iac, discovery
RDS Instance Class Not Preferred
CLDBRN-AWS-S3-1
aws
s3
iac, discovery
S3 Bucket Missing Lifecycle Configuration

inspect coverage fast

See which AWS services CloudBurn covers and which checks work in CI, discovery, or both before you spend time wiring it into your workflow.

ship with more confidence

The rules are readable and explicit, which makes findings easier to trust and makes cost checks easier to roll out across engineering teams.

start small, expand later

Start with the open-source CLI in one repo, prove the signal in CI, then add discovery or expand to more repos once the first team sees value.

One rules engine, two modes

Run the same cost rules before deploy and after deploy.

That is the core idea. CloudBurn is not two different products duct-taped together. The rule model stays consistent whether you are checking IaC in CI or inspecting a live AWS account.

scan

Catch waste in pull requests, CI jobs, and release pipelines.

Point CloudBurn at Terraform or CloudFormation and fail fast when a change introduces spending patterns your team should look at before merge.

cloudburn scan ./iac --exit-code
Terraform and CloudFormation
No AWS credentials required
Good fit for CI and local checks

discover

Inspect what is already deployed and still costing you money.

Run discover against one region or all of them after you initialize AWS Resource Explorer. Same rule language. Different target.

cloudburn discover --region all
Live AWS resources
Works across regions
Good fit for periodic audits

How it works

Treat cost review like a normal part of the delivery pipeline.

This is where CloudBurn gets practical. The commands are simple. The value comes from putting them in the right places and making the output visible to the team that can act on it.

01

Install it in minutes

Start with the GitHub repo, then install with Homebrew, npm, or npx if you want a fast first run.

brew install towardsthecloud/tap/cloudburn

02

Scan infrastructure before merge

Run scan against Terraform or CloudFormation in pull requests, CI jobs, or release pipelines.

cloudburn scan ./iac --exit-code

03

Discover what is already burning money

Point discover at a live AWS account and run the same rules against the resources you already deployed.

cloudburn discover --region all

04

Review output humans and machines can use

Table output works in a terminal. JSON output works when you want to automate, report, or feed another tool.

cloudburn --format json scan ./iac

Why teams roll it out

FinOps got trapped in dashboards. CloudBurn puts cost policy back in the workflow where engineers can act on it.

Most cost tooling shows you a problem after the money is already gone, then charges a premium to help you stare at it. CloudBurn is different. The rule engine is deterministic, shaped by years of AWS cost optimization work, and built to catch bad spending patterns before Terraform or CloudFormation reaches production. The same checks also run against live AWS so you can find what is already burning and fix it with a clean, usable overview.

Deterministic instead of hand-wavy

Every rule encodes a known bad AWS spending practice. That means teams get explicit checks they can review, trust, and tune instead of vague scoring models or another black-box dashboard.

Block waste before deploy

CloudBurn validates Terraform and CloudFormation before the change ships. That is the real wedge. It is cheaper to stop bad infrastructure in CI than to explain it in a cost review meeting two weeks later.

Use the same engine on live AWS

The value does not end at IaC. Run the same rule engine against your deployed environment with discovery and get focused optimization insights without buying into a bloated FinOps platform.

Questions
before you install

How is CloudBurn different from a typical FinOps dashboard?

Most FinOps tools show cost data after the spend already happened. CloudBurn focuses on deterministic policy checks that engineers can run before deploy with scan, then reuse against live AWS with discover. The goal is to stop bad spending patterns earlier, not just build another dashboard around them.

What can CloudBurn validate before deploy?

CloudBurn runs rules against Terraform and CloudFormation to catch known bad AWS spending practices before they reach production. That includes checks that work at IaC time only, plus checks that also make sense once the infrastructure is deployed.

Can it also check my live AWS environment?

Yes. discover runs the same rule engine against live AWS resources so you can find what is already wasting money in production. That keeps your policy language consistent between CI and the deployed environment.

How do I get started?

Install with brew install towardsthecloud/tap/cloudburn on macOS or Linux, or use npm install --global cloudburn. If you want a fast first run, start with npx cloudburn scan ./main.tf and inspect the rules before you wire it into CI.

What kind of output does CloudBurn produce?

CloudBurn supports both table and json output. Table output works well for engineers in the terminal. JSON output is useful when you want to automate reporting, integrate with internal tooling, or build on top of the SDK.

Is CloudBurn open source?

Yes. CloudBurn is open source under Apache 2.0. The GitHub repo is the front door, which makes it easy to try in one repo, validate the signal, and decide later how broadly you want to roll it out.

Get started

Stop paying for AWS mistakes after the fact.

Start with the open-source CLI. Run scan before deploy. Run discover against live AWS. Use one deterministic rule engine instead of another expensive dashboard.

Get CloudBurn on GitHubRead the documentation