The CloudBurn CLI gives you two ways to find cost savings in your AWS infrastructure:
- IaC scan — static analysis of Terraform (
.tf) and CloudFormation (.json,.yaml,.yml) files before deployment - Live discovery — real-time scan of resources running in your AWS account via Resource Explorer
Both modes run the same built-in rule catalog. The default AWS Core preset excludes the opt-in rules that need extra AWS setup. See Rules for the catalog and Configuration for how to change the selection.
IaC scan flow
Discovery flow
Which command do I need?
| Goal | Command |
|---|---|
| Scan local IaC files | cloudburn scan |
| Scan live AWS resources | cloudburn discover |
| Set up AWS Resource Explorer | cloudburn discover init |
| Check Resource Explorer status | cloudburn discover status |
| See which resource types are covered | cloudburn discover supported-resource-types |
| Collect fresh evidence for a scan | cloudburn discover --cache refresh |
| Generate a config file | cloudburn config --init |
| Print current config | cloudburn config --print |
| Preview the starter config template | cloudburn config --print-template |
| List available rules | cloudburn rules list |
| Inspect the estimate command scaffold | cloudburn estimate |
| Set up shell completions | cloudburn completion |
Global flags
These global flags control tracing and formatted command output. Shell completion scripts always print as shell code:
| Flag | Type | Description |
|---|---|---|
--debug | boolean | Write execution trace messages to stderr, prefixed with [debug] |
--format | "table" or "json" | Output format. Defaults to table, or to the format set for that scan mode in your config file |
cloudburn --debug discover
cloudburn --format json scan ./iac
GitHub Action
To run cloudburn scan on pull requests without installing the CLI, use the CloudBurn GitHub Action. It adds inline annotations, a sticky pull request comment, and severity gates.
AI agents and VS Code
Use the MCP plugin to run IaC scans, live discovery, and rule listing from an AI agent. The plugin bundles a local, read-only MCP server with a skill for reviewing findings.
Use the VS Code extension to scan saved Terraform and CloudFormation files and see findings in Problems. It runs your installed CLI with the same configuration used by terminal and CI scans.
Programmatic use
Need to integrate CloudBurn into your own tooling? See the SDK documentation.
What's next
| Installation | Install the CLI and verify it works |
| Quickstart: Scan IaC Files | Run your first IaC scan |
| Quickstart: Discover AWS Resources | Scan your live AWS account |