Configuration

CloudBurn reads configuration from a .cloudburn.yml (or .cloudburn.yaml) file. Outside CI, scan and discover walk up the directory tree from your current working directory toward the git root looking for a config file. Other commands do not apply scan configuration. See CI environments for explicit config loading in CI.

Generate a starter config

cloudburn config --init

This creates a .cloudburn.yml at your git root. See cloudburn config for details.

Full config schema

The config file has separate sections for iac (static scans) and discovery (live AWS scans). Both sections support the same keys.

iac:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-EC2-2
  services:
    - ebs
    - ec2
  format: table
  fail-on: high

discovery:
  enabled-rules:
    - CLDBRN-AWS-EBS-1
  disabled-rules:
    - CLDBRN-AWS-S3-1
  services:
    - ebs
    - s3
  format: json
  fail-on: high

Config keys

By default, CloudBurn runs the AWS Core preset. The preset excludes rules that need AWS-side setup; setting enabled-rules replaces the preset rather than merging with it. See Enabling and Disabling Rules for the opt-in rules and why each one is excluded.

The opt-in rules are all discovery-only, so they belong in the discovery section. Config validation rejects them under iac.

discovery:
  enabled-rules:
    - CLDBRN-AWS-COSTOPTIMIZATIONHUB-3
    - CLDBRN-AWS-LAMBDA-4

Precedence

CLI flags always take priority over config file values, which take priority over built-in defaults:

CLI flags > config file > defaults

For example, passing --format json on the command line overrides a format: table in your config file.

Validation

CloudBurn validates your config at startup and exits with an error if:

• The same rule ID appears in both enabled-rules and disabled-rules
• A rule ID in enabled-rules or disabled-rules does not exist
• A rule ID does not support the scan mode it appears in (e.g. a discovery-only rule in the iac section)
• A service name in services is not valid for that scan mode
• format is set to a value other than table or json
• fail-on is set to a value other than high, medium, or low
• A key other than iac or discovery appears at the top level, or a key other than the five above appears inside one of them
• Both .cloudburn.yml and .cloudburn.yaml exist in the same directory

Flags with no config key

The config file covers rule selection, output format, and the severity gate. These options are CLI flags only, so set them on each command:

CI environments

When the CI environment variable is set and truthy, CloudBurn skips implicit config file discovery and uses default values. This prevents unexpected config files in CI runners from affecting scan results. To use a config file in CI, pass it explicitly with --config.

Environment variables

Discovery reads a few process-level variables that have no flag or config key. They tune how independent CloudBurn processes running as the same OS user share AWS request quotas, and where that shared state lives.

Quotas are shared per signing AWS account, so discovery calls sts:GetCallerIdentity once per run. When that lookup fails, the run continues with isolated in-memory limits.

What's next