// the find
towardsthecloud/cloudburn
Open-source policy engine that blocks bad AWS spending patterns before they ship and remediates what's already burning.
CloudBurn is a CLI tool and SDK that runs deterministic cost rules against Terraform/CloudFormation (scan) and live AWS accounts (discover). It ships 75 rules covering EBS, EC2, RDS, Lambda, ELB, and a dozen other services. Aimed at teams who want cost guardrails in CI without paying for Cloudability or AWS Cost Anomaly Detection alone.
The two-mode design (IaC scan + live discover) using the same rule set is genuinely useful — you catch a misconfigured gp2 volume in the PR and find the forgotten one that already exists. The rule coverage is specific: not just 'unattached EBS' but gp3 extra IOPS, provisioned concurrency configured, RDS Performance Insights extended retention. These are the rules that actually show up in real AWS bills. The SDK package means you can embed it in your own tooling rather than shell out to the CLI. Test coverage looks thorough — near 1:1 rule-to-test-file ratio, which matters for a deterministic rules engine where a wrong threshold is a false positive that erodes trust.
The CLI targets one region at a time; multi-region discovery is SDK-only, which means any team with resources spread across regions needs to write their own wrapper or loop. Azure and GCP directories exist but are empty stubs — the multi-cloud branding is ahead of the actual implementation. Node 24+ requirement is aggressive; many CI environments are still on 20 or 22, and the Homebrew tap auto-installs Node but you don't control which version. There's no cost-estimate output — the rules tell you something is wrong but not roughly how much it's costing you, which makes it harder to prioritize fixes without cross-referencing Cost Explorer yourself.