Infrastructure-as-Code State Scan

This feature builds an assessment from a local Terraform or OpenTofu state file — the state, not your .tf source. Other IaC formats are not supported yet.

Use feature

Add --tfstate with a path to a state file. No cloud credentials are used and no API calls are made.

python3 main.py aws --tfstate infra.tfstate
python3 main.py azure --tfstate infra.tfstate

Terraform (>= 0.12) and every OpenTofu release write state format version 4, which is what the parser reads. Older v1–v3 states are rejected with an explicit error.

If your state lives in a remote backend (S3, Azure Storage, Terraform Cloud), export it first:

terraform state pull > infra.tfstate

The same mode is available through a configuration file:

{
  "cloudServiceProvider": 2,
  "exitStrategy": 1,
  "assessmentType": 1,
  "providerDetails": {
    "tfstatePath": "infra.tfstate"
  }
}

How it works

There is no account to connect to, so three steps are skipped — each reported explicitly rather than silently omitted:

• Credential check: no credentials are collected
• Permission check: no permissions are needed
• Cost inventory: billing data is not available offline

--egress requires live API access and is rejected when combined with --tfstate. Most data volumes come from CloudWatch and Azure Monitor metrics that a state file cannot supply, and a partial estimate covering only provisioned disks would understate the real figure.

Mixed states

A state file can hold resources from several providers. Only those belonging to the provider you selected are assessed; the rest are excluded, and the number excluded is reported on the console and in the manifest. If the state holds no resources for that provider at all, the run fails with a clear error rather than producing an empty report.