Synopsis
cloudburn rules list [--service <services>] [--severity <severity>] [--source <sources>]
Description
Lists all built-in CloudBurn rules. Use this command to discover available rule IDs, understand which services are covered, and see which scan modes (IaC or discovery) each rule supports.
That includes the opt-in rules the default AWS Core preset leaves switched off. See Rules for the catalog.
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--service | string | all services | Comma-separated list of services to filter by (e.g. ec2,ebs). |
--severity | string | all severities | One severity to include: high, medium, or low. |
--source | string | all sources | Comma-separated list of sources to filter by. Valid values: iac, discovery. |
--source keeps every rule that supports at least one of the listed modes, so --source iac also returns the rules that run in both modes. The Supports column shows which modes each rule supports.
Output columns
| Column | Description |
|---|---|
| RuleId | Unique rule identifier (e.g. CLDBRN-AWS-EBS-1) |
| Provider | Cloud provider (aws) |
| Service | AWS service the rule targets (e.g. ebs, ec2) |
| Severity | Relative cost impact: high, medium, or low |
| Supports | Which scan modes support this rule: iac, discovery, or both |
| Name | Short rule name |
| Description | What the rule checks and why it matters |
Examples
List all rules:
cloudburn rules list
List rules for EC2 only:
cloudburn rules list --service ec2
List rules supported by discovery mode for EC2:
cloudburn rules list --service ec2 --source discovery
List EBS and S3 rules that run during IaC scans:
cloudburn rules list --service ebs,s3 --source iac
List only high-severity rules:
cloudburn rules list --severity high
Example output for a single rule:
+------------------+----------+---------+----------+----------------+----------------------------------------+-----------------------------------------------------------------------------------------+
| RuleId | Provider | Service | Severity | Supports | Name | Description |
+------------------+----------+---------+----------+----------------+----------------------------------------+-----------------------------------------------------------------------------------------+
| CLDBRN-AWS-EBS-1 | aws | ebs | medium | discovery, iac | EBS Volume Type Not Current Generation | Flag EBS volumes using previous-generation storage types when a current-generation |
| | | | | | | replacement exists. |
+------------------+----------+---------+----------+----------------+----------------------------------------+-----------------------------------------------------------------------------------------+
cloudburn --format json rules list emits the same rule metadata as a JSON array, with supports as a list.
Rule documentation
For detailed documentation on each rule, see CloudBurn Rules.
What's next
| Rules | Detailed documentation for every rule |
| Configuration | Use rule IDs in enabled-rules / disabled-rules |
| cloudburn scan | Run a scan with specific rules enabled |