CONFIGURATION.md

Configuration

bucket-scanner init creates .bucket-scanner.toml in the project root.

[scan]
folder_id = "b1gxxxxxxxxxx"
# folder_ids = ["b1gfolder-a", "b1gfolder-b"]
fail_on = "high"
probe = false

[scan.ignore_buckets]
names = ["public-assets-cdn"]

[[scan.severity_overrides]]
rule = "versioning/disabled"
severity = "medium"

CLI flags override file values when both are set.

Multi-folder Yandex Cloud

Scan several folders in one run (merged inventory and findings):

[scan]
folder_ids = ["b1gfolder-prod", "b1gfolder-backup"]

Or on the CLI:

bucket-scanner scan --folder-id b1gfolder-a --folder-id b1gfolder-b

Scan profiles

Named presets for CI, demos, or continuous monitoring:

[[profiles]]
name = "aws-demo"
cloud = "aws"
fixture = "examples/demo-vulnerable/fixture-aws.toml"
terraform_path = "examples/demo-vulnerable/terraform-aws"

[[profiles]]
name = "yc-prod"
folder_ids = ["b1gfolder-prod", "b1gfolder-backup"]
probe = true

[serve]
addr = "127.0.0.1:9090"
interval_seconds = 300
profile = "yc-prod"

bucket-scanner scan --profile aws-demo
bucket-scanner serve --profile yc-prod --interval 300
bucket-scanner profiles list

Profile fields map to scan options (cloud, folder_id, folder_ids, aws_region, fixture, terraform_path, etc.). CLI flags still override profile values.

Baseline and suppressions

See BASELINE.md for the full CI workflow.

[scan]
baseline_path = "baselines/prod.json"

[[scan.suppressions]]
rule = "logging/disabled"
bucket = "public-assets-cdn"
reason = "CDN origin"
expires = "2026-12-31"

bucket-scanner scan --folder-id b1g... --write-baseline baselines/prod.json
bucket-scanner scan --folder-id b1g... --baseline baselines/prod.json --fail-on new