The thothctl inventory iac command creates, updates, and manages an inventory of Infrastructure as Code (IaC) components in your project. This inventory tracks modules, their versions, sources, and dependencies, providing valuable insights into your infrastructure composition with modern, professional HTML reports and comprehensive provider version analysis.
-cv) and provider versions (-cpv) — check what you needUsage: thothctl inventory iac [OPTIONS]
Create a inventory about IaC modules composition for terraform/tofu/terragrunt projects
Options:
-cv, --check-versions Check latest versions for modules
-cpv, --check-provider-versions Check latest versions for providers
--check-providers Check and report provider information for each stack
-ft, --framework-type [auto|terraform|terragrunt|terraform-terragrunt|module|cdkv2]
Framework type to analyze (auto for automatic detection)
-r, --report-type [html|json|cyclonedx|all]
Type of report to generate
-iact, --inventory-action [create|update|restore]
Action for inventory tasks
-iph, --inventory-path PATH Path for saving inventory reports
-pj, --project-name TEXT Custom project name for the report
--provider-tool [tofu|terraform]
Tool to use for checking providers (default: tofu)
--complete Include .terraform and .terragrunt-cache in analysis
-auto, --auto-approve Auto approve updating dependencies
--post-to-pr Post inventory summary as a PR comment
(Azure DevOps or GitHub)
--vcs-provider [auto|azure_repos|github]
VCS provider for PR comments (default:
auto-detect from CI environment)
--space TEXT Space name for credential resolution
(Azure DevOps)
--help Show this message and exit.
thothctl inventory iac
This creates an inventory of all IaC components in the current directory and generates a modern HTML report in the default location (./Reports/Inventory).
# Check module versions only
thothctl inventory iac -cv
# Check provider versions only
thothctl inventory iac -cpv
# Check both module and provider versions
thothctl inventory iac -cv -cpv
# Provider info without version lookup
thothctl inventory iac --check-providers
# HTML report with modern styling (default)
thothctl inventory iac --report-type html
# JSON report for automation
thothctl inventory iac --report-type json
# CycloneDX SBOM report (OWASP standard)
thothctl inventory iac --report-type cyclonedx
# All report types (HTML, JSON, and CycloneDX)
thothctl inventory iac --report-type all
thothctl inventory iac \
-cv -cpv \
--inventory-path ./docs/infrastructure \
--project-name "Production Infrastructure"
The new HTML reports feature:
ThothCTL now supports generating CycloneDX Software Bill of Materials (SBOM) reports, following the OWASP CycloneDX standard:
# Generate CycloneDX SBOM for security audit
thothctl inventory iac -cv -cpv --report-type cyclonedx
# Complete analysis with all formats including SBOM
thothctl inventory iac -cv -cpv --report-type all
The CycloneDX report includes:
The --check-versions flag now provides comprehensive analysis:
thothctl inventory iac --check-versions
What it does:
If you only want provider information without version checking:
thothctl inventory iac --check-providers
The reports now include comprehensive provider data:
When --check-versions is enabled, ThothCTL calculates a technical debt score that reflects how outdated your infrastructure is.
The debt score uses a weighted approach that separates module health from provider health:
module_debt = outdated_modules / total_modules (weight: 70%)
provider_debt = outdated_providers / total_providers (weight: 30%)
debt_score = (module_debt × 0.7 + provider_debt × 0.3) × 100 + breaking_changes_penalty
Why weighted? Modules define your architecture and are the primary source of risk. Providers are dependencies that may be intentionally pinned (e.g., a latest module tested against a specific provider version). A single outdated provider should not inflate the score disproportionately.
Each module or provider with detected breaking changes adds +5 points to the debt score (capped at 100%).
| Debt Score | Risk Level | Meaning |
|---|---|---|
| ≥ 70% | Critical | Immediate action required |
| ≥ 50% | High | Plan upgrades soon |
| ≥ 30% | Medium | Schedule maintenance |
| < 30% | Low | Infrastructure is well-maintained |
| Scenario | Score | Risk |
|---|---|---|
| 2 modules current, 1/2 providers outdated | 15% | Low |
| 2/4 modules outdated, providers current | 35% | Medium |
| All modules and providers outdated | 100% | Critical |
| Everything current | 0% | Low |
The system auto-generates actionable recommendations based on the metrics:
The inventory iac command now supports AWS CDK projects (TypeScript and Python). When cdk.json is detected in your project, ThothCTL automatically switches to CDK inventory mode.
# In a CDK TypeScript project
thothctl inventory iac --check-versions
# Detects constructs: aws-cdk-lib, cdk-nag, @myorg/cdk-patterns, constructs, etc.
Parses package.json and package-lock.json to identify CDK construct libraries, then queries the npm registry for latest versions and release dates.
# In a CDK Python project
thothctl inventory iac --check-versions
# Detects constructs: aws-cdk-lib, cdk-nag, constructs, etc.
Parses requirements.txt or pyproject.toml to identify CDK construct libraries, then queries PyPI for latest versions and release dates.
You can also explicitly select CDK mode:
thothctl inventory iac --framework-type cdkv2 --check-versions
cdk.json exists, CDK mode is selected automatically (no --framework-type needed)@myorg/cdk-patterns) are listed but not version-checkedpkg:npm/ or pkg:pypi/ PURL schemesthothctl inventory iac --framework-type auto
Automatically detects the framework type based on project files.
thothctl inventory iac --framework-type terraform --check-versions
Analyzes Terraform files (.tf) with version checking.
thothctl inventory iac --framework-type terragrunt --check-versions
Analyzes Terragrunt files (terragrunt.hcl) with comprehensive provider analysis.
thothctl inventory iac --framework-type terraform-terragrunt --check-versions
Analyzes both Terraform and Terragrunt files with full version checking.
thothctl inventory iac --inventory-action create --check-versions
Scans IaC files and creates a new inventory with version analysis.
thothctl inventory iac \
--inventory-action update \
--inventory-path ./path/to/inventory.json \
--auto-approve
Updates IaC files based on the inventory.
thothctl inventory iac \
--inventory-action restore \
--inventory-path ./path/to/inventory.json
Restores IaC files to the state recorded in the inventory.
thothctl inventory iac \
--check-versions \
--report-type all \
--project-name "Production Infrastructure Audit" \
--inventory-path ./docs/audit
This generates:
thothctl inventory iac \
--framework-type terragrunt \
--check-versions \
--project-name "Terragrunt Infrastructure"
# In your CI/CD pipeline
thothctl inventory iac \
--check-versions \
--report-type json \
--inventory-path ./reports/$(date +%Y-%m-%d)
# Post inventory summary as a PR comment
thothctl inventory iac --check-versions --post-to-pr
The --post-to-pr flag posts an inventory summary table directly to the pull request, including component counts, provider stats, and technical debt metrics.
# GitHub Actions example
- run: thothctl inventory iac --check-versions --post-to-pr
env:
GITHUB_TOKEN: $
# Azure Pipelines example (uses built-in System.AccessToken, no PAT needed)
- script: thothctl inventory iac --check-versions --post-to-pr
env:
AZDO_PERSONAL_ACCESS_TOKEN: $(System.AccessToken)
Platform comment size limits (GitHub: 65K chars, Azure DevOps: 150K chars) are enforced automatically with truncation. See check iac PR comment docs for full platform setup details, including required Azure DevOps build service permissions.
thothctl inventory iac \
--check-versions \
--complete \
--report-type all \
--project-name "Complete Infrastructure Analysis" \
--provider-tool tofu \
--inventory-path ./comprehensive-analysis
{
"version": 2,
"projectName": "my-project",
"projectType": "terraform-terragrunt",
"components": [
{
"stack": "./stacks/networking",
"components": [
{
"type": "module",
"name": "vpc",
"version": ["5.0.0"],
"source": ["terraform-aws-modules/vpc/aws"],
"latest_version": "5.19.0",
"source_url": "https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws",
"status": "Outdated"
}
],
"providers": [
{
"name": "aws",
"version": "6.0.0",
"source": "registry.opentofu.org/hashicorp/aws",
"module": "Root",
"component": "networking",
"latest_version": "6.2.0",
"status": "outdated"
}
]
}
],
"provider_version_stats": {
"total_providers": 15,
"outdated_providers": 3,
"current_providers": 12,
"unknown_providers": 0
}
}
thothctl inventory iac --check-versions --report-type all
Benefits:
# Create inventory with version analysis
thothctl inventory iac --check-versions --report-type json
# Review the generated report for outdated components
# Update modules based on findings
thothctl inventory iac \
--check-versions \
--project-name "Production Infrastructure Documentation" \
--report-type html
Generates professional documentation with:
thothctl inventory iac \
--check-versions \
--complete \
--report-type all
Helps with:
# In your pipeline
thothctl inventory iac \
--check-versions \
--report-type json \
--inventory-path ./reports/$(date +%Y-%m-%d)
# Parse JSON output for automated decision making
# Run weekly to identify outdated components
thothctl inventory iac --check-versions
# For thorough audits, use all features
thothctl inventory iac \
--check-versions \
--complete \
--report-type all \
--project-name "Monthly Infrastructure Audit"
# Generate consistent documentation
thothctl inventory iac \
--check-versions \
--project-name "$(basename $(pwd)) Infrastructure" \
--inventory-path ./docs/infrastructure
# Use OpenTofu for modern Terraform workflows
thothctl inventory iac --check-versions --provider-tool tofu
# Use Terraform for legacy workflows
thothctl inventory iac --check-versions --provider-tool terraform
# Organize reports by date and environment
thothctl inventory iac \
--check-versions \
--inventory-path ./reports/$(date +%Y-%m)/production \
--project-name "Production Infrastructure - $(date +%B\ %Y)"
The recent updates have resolved all CSS variable issues that previously caused HTML report generation failures.
Error: Failed to check versions for module xyz
Solution: Ensure internet connectivity and module source accessibility.
Error: Failed to get providers for stack xyz
Solution:
tofu init or terraform init in problematic directoriesError: Failed to generate HTML report
Solution: Ensure write permissions to the output directory.
For detailed logs:
thothctl --debug inventory iac --check-versions
# Old redundant flags
thothctl inventory iac --check-providers --check-provider-versions --check-versions
# New unified approach
thothctl inventory iac --check-versions
Benefits of the new approach:
The thothctl inventory iac command now provides:
--check-versions flagUse thothctl inventory iac --check-versions for the best experience with comprehensive analysis and modern reporting.