scanStatic() analyzes your infrastructure-as-code files locally — no AWS credentials required. It parses Terraform and CloudFormation files and applies CloudBurn's cost optimization rules. For AWS CDK, synthesize your app and scan the generated CloudFormation templates in cdk.out/.
Full example
import { CloudBurnClient } from '@cloudburn/sdk';
const client = new CloudBurnClient();
const result = await client.scanStatic('./infrastructure');
for (const provider of result.providers) {
for (const finding of provider.rules) {
console.log(`[${finding.ruleId}] ${finding.message}`);
for (const match of finding.findings) {
console.log(` ${match.resourceId} at ${match.location?.path}:${match.location?.line}`);
}
}
}
ScanResult shape
scanStatic() returns a Promise<ScanResult>:
type ScanResult = {
diagnostics?: ScanDiagnostic[]; // skipped files and other non-fatal problems
policy?: ScanPolicyResult; // present when iac.failOn is configured
providers: ProviderFindingGroup[];
suppressed?: SuppressedFinding[]; // findings withheld by cloudburn-ignore comments
};
type ProviderFindingGroup = {
provider: CloudProvider; // 'aws' | 'azure' | 'gcp'
rules: Finding[];
};
type Finding = {
ruleId: string;
service: string;
source: Source; // 'iac' for static scans
severity: Severity; // 'high' | 'medium' | 'low'
message: string;
findings: FindingMatch[];
};
type FindingMatch = {
resourceId: string;
resourceType?: string; // provider namespace, when needed to disambiguate
actionType?: string; // recommended operation, when one resource has several
accountId?: string;
region?: string;
recommendation?: FindingRecommendation;
impact?: FindingImpact;
location?: SourceLocation; // file path + line/column
};
result.providers is an array grouped by cloud provider. Each Finding represents one rule that matched, and findings lists every individual resource that triggered it. See Types Reference for the full shape of ScanPolicyResult and SuppressedFinding.
Static scans never populate evidence or evaluations. Those fields only appear on discovery results.
Filtering with config
Pass an inline config to scope the scan to specific services or rules:
const result = await client.scanStatic('./iac', {
iac: {
services: ['ec2', 'ebs'],
},
});
Enable or disable specific rules:
const result = await client.scanStatic('./iac', {
iac: {
enabledRules: ['CLDBRN-AWS-EBS-1', 'CLDBRN-AWS-EC2-1'],
},
});
You can also load config from a file and merge overrides:
const config = await client.loadConfig();
const result = await client.scanStatic('./iac', {
...config,
iac: { ...config.iac, services: ['ec2'] },
});
What's next
| Quickstart: Discovery Scan | Scan live AWS resources |
| Custom Configuration | Load and override config programmatically |
| Rules | Browse available rules and rule IDs |