Support discovery baselines for brownfield accounts

Open
#104 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
42/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
aws, typescript
Domain
cli, cloud, devops

Research direction

Start by reading the existing discovery configuration under packages/sdk/src/config/ and the inline-suppression behavior for IaC. Trace the cloudburn discover entry point, then define how baseline entries match findings and how excluded counts or JSON are reported. Done means an accepted baseline can be generated, referenced, and audited without hiding excluded findings.

Written by the indexing model from the issue text.

Description

enhancement

What

Support excluding accepted findings from discover runs via config or a committed baseline file: resource IDs/ARNs accepted per rule, with an optional command to generate the baseline from a current run.

Why

A first discover against an existing account evaluates 72 discovery-capable rules and produces a wall of findings with no way to ratchet. Teams need to accept current state, then fail only on new waste — the standard brownfield-adoption pattern for policy tools.

Details

  • Config shape: per-rule exclusion lists under the existing discovery mode section (packages/sdk/src/config/), or a dedicated baseline file referenced from config.
  • Matching keys off FindingMatch.resourceId (plus region/accountId where present).
  • A cloudburn discover --write-baseline (or discover baseline subcommand) that snapshots current findings into the file, so adoption is one command.
  • Excluded findings surface as a count / JSON array, mirroring the inline-suppression behavior for IaC, so nothing disappears silently.
  • Baseline entries should support an optional reason/date for auditability.
Dominant language
TypeScript
Stars
1.8k
Forks
371
Avg merge
4h 32m
Merged PRs (30d)
63

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from towardsthecloud/cloudburn

All issues in towardsthecloud/cloudburn

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.