Skip to main content

Configuration

The CCA CLI is configured three ways, in precedence order:

  1. Command-line flags — highest priority (see Command Reference).
  2. Environment variables — e.g. CCA_API_KEY, CCA_MODE, AWS_PROFILE (see Environment Variables).
  3. Stored API key — saved by cca login and used as a fallback.

There is no separate config file or config command — flags and environment variables cover everything, and cca login handles the one value you'd otherwise repeat.

Storing your API key​

For managed mode, run cca login once so you don't pass --api-key (or export CCA_API_KEY) on every run:

# Uses the key from --api-key / CCA_API_KEY if set, otherwise prompts
cca login

The key is written to ~/.cloud-cost-analyzer/credentials.json with owner-only (0600) permissions. Remove it with cca logout.

Resolution precedence for the key: --api-key flag → CCA_API_KEY env → stored credentials file.

Setting defaults per environment​

Because configuration is flags + env, use environment variables or shell aliases to switch environments rather than config files:

# AWS credentials come from the standard chain — switch with AWS_PROFILE
AWS_PROFILE=production cca scan --provider aws --regions us-east-1,us-west-2

# Or wrap common flags in an alias (in ~/.bashrc or ~/.zshrc)
alias cca-prod='AWS_PROFILE=production cca scan --provider aws --regions us-east-1'

For CI, set the relevant environment variables as secrets — see Environment Variables and GitHub Actions.

IAM Permissions​

CCA requires read-only access to analyze resources. cca setup can create a least-privilege role for you (cca setup --provider aws --deploy), or apply this minimal policy manually:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:Describe*",
        "s3:GetBucket*",
        "s3:ListBucket",
        "elasticloadbalancing:Describe*",
        "lambda:List*",
        "lambda:GetFunction",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "ce:GetCostAndUsage",
        "pricing:GetProducts"
      ],
      "Resource": "*"
    }
  ]
}

See the AWS provider guide for the full policy. For Azure, assign the Reader role to the service principal at the subscription level.

Proxy Configuration​

CCA respects the standard proxy environment variables:

export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1

cca scan --provider aws

Next Steps​