cloudburn config

Synopsis

cloudburn config --init [--path <path>]
cloudburn config --print [--path <path>]
cloudburn config --print-template

Description

Manages CloudBurn configuration files. You must pass exactly one of --init, --print, or --print-template.

• --init creates a starter .cloudburn.yml at your git root (or at --path if specified). If a config file already exists, the command exits with an error.
• --print outputs the current config file to stdout. Without --path, it walks up the directory tree toward the git root looking for .cloudburn.yml or .cloudburn.yaml.
• --print-template outputs the built-in starter template to stdout without touching the filesystem.

--print and --print-template write raw YAML by default. Passing the global --format wraps that YAML in a document envelope instead: cloudburn --format json config --print returns { "content": "...", "contentType": "application/yaml" }, and --format table renders the same two fields as a table.

Flags

Starter template

Running cloudburn config --init creates the following file:

# Static IaC scan configuration.
# enabled-rules replaces the AWS Core preset with only the listed rule IDs.
# It can also activate opt-in rules that are not in AWS Core.
# disabled-rules removes specific rule IDs from the selected set.
# services restricts scans to rules for the listed services.
# format sets the default output format when --format is not passed.
# fail-on gates CI on findings at or above high, medium, or low severity.
iac:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-EC2-2
  services:
    - ebs
    - ec2
  format: table
  # fail-on: high

# Live AWS discovery configuration.
# Use the same rule controls here to tune discover runs separately from IaC scans.
discovery:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-S3-1
  services:
    - ebs
    - s3
  format: json
  # fail-on: high

CloudBurn does not implicitly trust repository config in CI. Pass the exact file explicitly when you want CI to use its rule selection, output defaults, or severity gate:

cloudburn scan ./iac --config .cloudburn.yml
cloudburn discover --config .cloudburn.yml

Examples

Create a config file at your git root:

cloudburn config --init

Create a config file at a specific path:

cloudburn config --init --path ./my-project/.cloudburn.yml

Print the current config:

cloudburn config --print

Preview the starter template without writing a file:

cloudburn config --print-template

What's next