Quickstart: Scan IaC Files

This tutorial walks you through running your first CloudBurn scan against local Terraform or CloudFormation files.

Step 1: Install CloudBurn

If you haven't installed the CLI yet, see Installation.

npm install --global cloudburn

Step 2: Navigate to your IaC directory

Change into the directory that contains your Terraform (.tf) or CloudFormation (.json, .yaml, .yml) files:

cd ./infrastructure

Step 3: Run the scan

Run CloudBurn scan against the current directory:

cloudburn scan

Or point it at a specific path:

cloudburn scan ./path/to/iac

CloudBurn auto-detects file types — you don't need to specify whether you're using Terraform or CloudFormation.

Step 4: Read the output

By default, CloudBurn outputs a table of findings. Each row represents one finding:

+----------+------------------+----------+--------+---------+---------------------+-------------------------+------+--------+----------------------------------------------------+
| Provider | RuleId           | Severity | Source | Service | ResourceId          | Path                    | Line | Column | Message                                            |
+----------+------------------+----------+--------+---------+---------------------+-------------------------+------+--------+----------------------------------------------------+
| aws      | CLDBRN-AWS-EBS-1 | medium   | iac    | ebs     | aws_ebs_volume.main | modules/storage/main.tf | 12   | 1      | EBS volumes should use current-generation storage. |
+----------+------------------+----------+--------+---------+---------------------+-------------------------+------+--------+----------------------------------------------------+

Column meanings:

Column widths follow your terminal, and columns with no data for the run are dropped. Discovery findings fill in other columns instead, such as Region and AccountId. See Finding columns.

Step 5: Filter by service

To scan only specific AWS services:

cloudburn scan --service ebs

Multiple services:

cloudburn scan --service ebs,ec2

Step 6: Use JSON output

For machine-readable output — useful for scripts or CI pipelines:

cloudburn --format json scan ./iac

Pipe to jq to extract specific fields:

cloudburn --format json scan ./iac | jq '.providers[].rules[]'

Step 7: Use exit codes for CI

Pass --exit-code to make the command exit with code 1 when any active finding exists. This lets you fail CI builds:

cloudburn scan --exit-code

To fail CI only above a severity threshold instead, use --fail-on:

cloudburn scan --fail-on high

Exit codes:

What's next