Configuration | CloudBurn CLI

CloudBurn reads configuration from a .cloudburn.yml (or .cloudburn.yaml) file. When you run any CloudBurn command, it walks up the directory tree toward the git root looking for a config file.

Generate a starter config

cloudburn config --init

This creates a .cloudburn.yml at your git root. See cloudburn config for details.

Full config schema

The config file has separate sections for iac (static scans) and discovery (live AWS scans). Both sections support the same keys.

iac:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-EC2-2
  services:
    - ebs
    - ec2
  format: table
  fail-on: high

discovery:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-S3-1
  services:
    - ebs
    - s3
  format: json
  fail-on: high

Config keys

Key	Type	Default	Description
`enabled-rules`	`string[]`	AWS Core preset	Replaces the AWS Core preset with only the listed rule IDs. Also the way to activate opt-in rules, such as `CLDBRN-AWS-TAGGING-1`, that AWS Core excludes.
`disabled-rules`	`string[]`	none	Skip these rule IDs from the selected set.
`services`	`string[]`	all services	Only run rules for these services (e.g. `ebs`, `ec2`, `s3`).
`format`	`"table"` or `"json"`	`"table"`	Default output format for this scan type.
`fail-on`	`"high"`, `"medium"`, `"low"`	none	Exit with code `1` when an active finding meets or exceeds this severity. Equivalent to the `--fail-on` CLI flag.

By default, CloudBurn runs the AWS Core preset — every built-in rule except account-wide opt-in rules such as CLDBRN-AWS-TAGGING-1 (Enabling and Disabling Rules explains the exclusion). Setting enabled-rules replaces the preset entirely; it is not merged with it.

Precedence

CLI flags always take priority over config file values, which take priority over built-in defaults:

CLI flags > config file > defaults

For example, passing --format json on the command line overrides a format: table in your config file.

Validation

CloudBurn validates your config at startup and exits with an error if:

The same rule ID appears in both enabled-rules and disabled-rules
A rule ID in enabled-rules or disabled-rules does not exist
A rule ID does not support the scan mode it appears in (e.g. a discovery-only rule in the iac section)
A service name in services is not valid for that scan mode
format is set to a value other than table or json
fail-on is set to a value other than high, medium, or low

CI environments

When the CI environment variable is set and truthy, CloudBurn skips implicit config file discovery and uses default values. This prevents unexpected config files in CI runners from affecting scan results. To use a config file in CI, pass it explicitly with --config.

What's next


Quickstart: Scan IaC Files	Use your config in a real scan
cloudburn scan	All flags for the scan command
cloudburn rules list	Find valid rule IDs to use in your config