Package Exports

import { CloudBurnClient, builtInRuleMetadata, parseIaC, evaluateScanPolicy, assertValidAwsRegion, assertSupportedAwsRegion, withAwsClientCredentials, isAwsDiscoveryErrorCode, awsCorePreset, SEVERITIES } from '@cloudburn/sdk';

import { CloudBurnClient } from '@cloudburn/sdk';

const client = new CloudBurnClient();

import { builtInRuleMetadata } from '@cloudburn/sdk';

// List all AWS EC2 rules
const ec2Rules = builtInRuleMetadata.filter(
  (rule) => rule.provider === 'aws' && rule.service === 'ec2'
);

for (const rule of ec2Rules) {
  console.log(`${rule.id}: ${rule.name}`);
}

type BuiltInRuleMetadata = {
  id: string;
  name: string;
  description: string;
  provider: CloudProvider;
  service: string;
  severity: Severity;
  supports: Source[];
};

parseIaC(
  path: string,
  options?: {
    sourceKinds?: ('cloudformation' | 'terraform')[];
  }
): Promise<{ provider: CloudProvider; type: string; name: string; location?: SourceLocation; attributes: Record<string, unknown> }[]>

import { parseIaC } from '@cloudburn/sdk';

const resources = await parseIaC('./infrastructure');

for (const resource of resources) {
  console.log(`${resource.provider}/${resource.type} "${resource.name}"`);
  if (resource.location) {
    console.log(`  at ${resource.location.path}:${resource.location.line}`);
  }
}

evaluateScanPolicy(result: ScanResult, threshold?: Severity): ScanPolicyResult

import { evaluateScanPolicy } from '@cloudburn/sdk';

const result = await client.scanStatic('./infrastructure');
const policy = evaluateScanPolicy(result, 'medium');

if (policy.violated) {
  console.error(`${policy.qualifyingFindingCount} findings at or above 'medium' severity`);
  process.exitCode = 1;
}

assertValidAwsRegion(region: unknown): asserts region is string

import { assertValidAwsRegion } from '@cloudburn/sdk';

const region = process.env.AWS_REGION;
assertValidAwsRegion(region); // throws if region is undefined or invalid

// region is now typed as string
const result = await client.discover({ target: { mode: 'region', region } });

assertSupportedAwsRegion(region: string): AwsRegion

import { assertSupportedAwsRegion } from '@cloudburn/sdk';

const region = assertSupportedAwsRegion('us-east-1'); // returns typed AwsRegion
assertSupportedAwsRegion('not-a-region'); // throws AwsDiscoveryError

withAwsClientCredentials<T>(
  credentials: AwsClientCredentials | undefined,
  fn: () => Promise<T>
): Promise<T>

import { withAwsClientCredentials } from '@cloudburn/sdk';
import { fromTemporaryCredentials } from '@aws-sdk/credential-providers';

const credentials = fromTemporaryCredentials({
  params: { RoleArn: 'arn:aws:iam::111111111111:role/cloudburn-readonly' },
});

const result = await withAwsClientCredentials(credentials, () =>
  client.discover({ target: { mode: 'current' } }),
);

isAwsDiscoveryErrorCode(code: unknown): code is string

import { isAwsDiscoveryErrorCode } from '@cloudburn/sdk';

const result = await client.discover();

for (const diag of result.diagnostics ?? []) {
  if (diag.code && isAwsDiscoveryErrorCode(diag.code)) {
    console.error(`Discovery error [${diag.code}]: ${diag.message}`);
  }
}

const awsCorePreset: {
  id: string;
  name: string;
  description: string;
  ruleIds: string[];
};

import { awsCorePreset } from '@cloudburn/sdk';

console.log(`Default rule count: ${awsCorePreset.ruleIds.length}`);

const SEVERITIES: readonly ['high', 'medium', 'low'];

import { SEVERITIES } from '@cloudburn/sdk';

const requested = process.env.FAIL_ON;
if (requested && !SEVERITIES.includes(requested as (typeof SEVERITIES)[number])) {
  throw new Error(`Invalid severity "${requested}". Use one of: ${SEVERITIES.join(', ')}`);
}