Skip to content

CCE guides

Focused guides for teams extending CCE beyond the built-in cloud mapper. Each doc explains what the concept is, why it matters, and how to implement it.

Part of the CCE user docs. Preview: make docs-serve from the repo root.

Guide Audience Summary
Enterprise lenses and catalogs Platform engineering, security, enterprise IDP owners Document internal developer-platform libraries with custom lenses and optional private catalogs
Entitlements, operations, and IAM IAM / PoLP, SRE, service owners How read vs write (and multiple API actions) appear in scans; aggregating entitlements for least privilege
Topic Page
Custom lens YAML Grok rules, prefixes, data tables
Analysis recipes Catalog schema, packs, cce run, CI policies
Cloud entitlements Built-in PoLP scan
Platform adoption Platform SDK lens template
Known limitations Facades, languages, static analysis bounds

Quick paths

# Custom lens only (no catalog change)
cce -folder . -language AUTO -filter all \
  -mapper-file ./corp/idp-lenses.yaml -format json -output idp.json

# Private catalog + pack (host catalog.json on HTTPS)
cce run -folder . -language AUTO -pack corp-platform-pack -remote \
  -catalog-url https://artifacts.example.com/cce/recipes/latest/catalog.json \
  -packs-url https://artifacts.example.com/cce/recipes/latest/packs.json \
  -output platform.json