Environment Variables
Cloud Cost Analyzer can be configured using environment variables. These are useful for CI/CD pipelines and automation.
CCA Configuration
Each of these mirrors a global CLI flag; the flag takes precedence when both are set.
| Variable | Description | Default |
|---|---|---|
CCA_API_KEY | API key for managed mode (sends results to the dashboard) | - |
CCA_MODE | Execution mode: managed or local (local needs an air-gapped build) | managed |
CCA_LICENSE | Base64-encoded license key (premium/air-gapped) | - |
CCA_LICENSE_FILE | Path to a license file (premium/air-gapped) | - |
CCA_BUNDLE_PATH | Path to a signed rule bundle (air-gapped) | - |
Output format and logging are set with flags, not env vars: --output, and --verbose / --log-level / --log-format / --log-file. To store the API key instead of exporting it each run, use cca login.
AWS Credentials
CCA uses the standard AWS credential chain. You can configure credentials using:
| Variable | Description |
|---|---|
AWS_ACCESS_KEY_ID | AWS access key |
AWS_SECRET_ACCESS_KEY | AWS secret key |
AWS_SESSION_TOKEN | Session token (for temporary credentials) |
AWS_REGION | AWS region to scan |
AWS_PROFILE | Named profile from ~/.aws/credentials |
AWS_DEFAULT_REGION | Fallback region |
Credential Priority
- Environment variables (
AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY) - Shared credentials file (
~/.aws/credentials) - IAM role (if running on EC2/ECS/Lambda)
Azure Credentials
CCA uses service principal authentication for Azure:
| Variable | Description |
|---|---|
AZURE_CLIENT_ID | Service principal application ID |
AZURE_CLIENT_SECRET | Service principal secret |
AZURE_TENANT_ID | Azure AD tenant ID |
AZURE_SUBSCRIPTION_ID | Subscription ID to scan |
Setting Up Azure Credentials
# Create a service principal with Reader access
az ad sp create-for-rbac \
--name "cca-reader" \
--role Reader \
--scopes /subscriptions/YOUR_SUBSCRIPTION_ID
# Output:
# {
# "appId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", <- AZURE_CLIENT_ID
# "password": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", <- AZURE_CLIENT_SECRET
# "tenant": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" <- AZURE_TENANT_ID
# }
Example: Full CI Configuration
# .env.ci (load with source or dotenv)
# CCA
CCA_API_KEY=cca_live_xxxxxxxxxxxxx
# AWS
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
AWS_REGION=us-east-1
# Azure (optional)
AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
AZURE_CLIENT_SECRET=your-secret
AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
AZURE_SUBSCRIPTION_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
caution
Never commit credential files to version control. Use your CI system's secret management to inject these values.
Next Steps
- CLI Commands - Full command reference
- CLI Configuration - Flags, env, and stored credentials
- GitHub Actions - CI/CD integration