cloudburn config | CloudBurn CLI

Synopsis

cloudburn config --init [--path <path>]
cloudburn config --print [--path <path>]
cloudburn config --print-template

Description

Manages CloudBurn configuration files. You must pass exactly one of --init, --print, or --print-template.

--init creates a starter .cloudburn.yml at your git root (or at --path if specified). If a config file already exists, the command exits with an error.
--print outputs the current config file to stdout. Without --path, it walks up the directory tree toward the git root looking for .cloudburn.yml or .cloudburn.yaml.
--print-template outputs the built-in starter template to stdout without touching the filesystem.

Flags

Flag	Type	Default	Description
`--init`	`boolean`	`false`	Create a starter config file
`--print`	`boolean`	`false`	Print the current config file to stdout
`--print-template`	`boolean`	`false`	Print the built-in starter template to stdout
`--path <path>`	`string`		Explicit file path for `--init` or `--print`. Not valid with `--print-template`.

Starter template

Running cloudburn config --init creates the following file:

# Static IaC scan configuration.
# enabled-rules replaces the AWS Core preset with only the listed rule IDs.
# It can also activate opt-in rules that are not in AWS Core.
# disabled-rules removes specific rule IDs from the selected set.
# services restricts scans to rules for the listed services.
# format sets the default output format when --format is not passed.
# fail-on gates CI on findings at or above high, medium, or low severity.
iac:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-EC2-2
  services:
    - ebs
    - ec2
  format: table
  # fail-on: high

# Live AWS discovery configuration.
# Use the same rule controls here to tune discover runs separately from IaC scans.
discovery:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-S3-1
  services:
    - ebs
    - s3
  format: json
  # fail-on: high

CloudBurn does not implicitly trust repository config in CI. Pass the exact file explicitly when you want CI to use its rule selection, output defaults, or severity gate:

cloudburn scan ./iac --config .cloudburn.yml
cloudburn discover --config .cloudburn.yml

Examples

Create a config file at your git root:

cloudburn config --init

Create a config file at a specific path:

cloudburn config --init --path ./my-project/.cloudburn.yml

Print the current config:

cloudburn config --print

Preview the starter template without writing a file:

cloudburn config --print-template

What's next


Configuration	Full reference for all config keys
cloudburn rules list	Find rule IDs to use in `enabled-rules`
Quickstart: Scan IaC Files	Run your first scan with the config