thothctl

ThothCTL Inventory Commands

Overview

The thothctl inventory command group provides tools for creating, managing, and updating inventories of your infrastructure components. These inventories help you track modules, their versions, sources, and dependencies, providing valuable insights into your infrastructure composition with modern, professional reporting and comprehensive analysis.

Recent Improvements ✨

🎯 Unified Version Checking: Single --check-versions flag handles both module and provider version checking
🎨 Modern HTML Reports: Professional styling with Inter font, gradients, and responsive design
📊 Enhanced Provider Analysis: Comprehensive provider version tracking with status indicators
🚀 Intelligent Automation: Automatic provider checking when version checking is enabled
📱 Responsive Design: Reports work perfectly on desktop, tablet, and mobile devices

Available Inventory Commands

inventory iac - Infrastructure as Code Inventory

Creates a comprehensive inventory of Infrastructure as Code (IaC) components in your project.

# Recommended: Comprehensive analysis with modern reporting
thothctl inventory iac --check-versions

# Basic inventory with modern HTML report
thothctl inventory iac

# Complete analysis with all report types
thothctl inventory iac --check-versions --report-type all

Key Features:

✅ Modern HTML Reports: Professional styling suitable for business use
✅ Provider Version Analysis: Comprehensive provider version tracking
✅ Unified Version Checking: Single flag for all version analysis
✅ Multi-Framework Support: Terraform, OpenTofu, and Terragrunt
✅ Responsive Design: Works on all devices and screen sizes

Common Options

Essential Options

-cv, --check-versions: 🚀 Recommended - Checks latest versions for modules and providers (includes provider version checking)
-r, --report-type [html|json|all]: Type of report to generate (default: html with modern styling)
-pj, --project-name TEXT: Custom project name for professional reports
-iph, --inventory-path PATH: Where to save inventory reports (default: ./Reports)

Framework and Analysis Options

-ft, --framework-type [auto|terraform|terragrunt|terraform-terragrunt]: Framework type to analyze (auto-detection recommended)
--check-providers: Check provider information (automatically enabled with --check-versions)
--provider-tool [tofu|terraform]: Tool for provider analysis (default: tofu)
--complete: Include .terraform and .terragrunt-cache folders

Action Options

-iact, --inventory-action [create|update|restore]: Action to perform (default: create)
--auto-approve: Auto-approve updates without confirmation
--update-dependencies-path: Path to inventory JSON for updates

Framework Types

Auto-detect Framework (Recommended)

thothctl inventory iac --framework-type auto --check-versions

Automatically detects the framework type and provides comprehensive analysis.

Terraform Framework

thothctl inventory iac --framework-type terraform --check-versions

Analyzes Terraform files (.tf) with modern reporting and version checking.

Terragrunt Framework

thothctl inventory iac --framework-type terragrunt --check-versions

Analyzes Terragrunt files (terragrunt.hcl) with provider version analysis.

Mixed Terraform-Terragrunt Framework

thothctl inventory iac --framework-type terraform-terragrunt --check-versions

Analyzes both Terraform and Terragrunt files with comprehensive reporting.

Report Types

Modern HTML Reports (Default) 🎨

thothctl inventory iac --check-versions --report-type html

Features:

Professional Design: Inter font, gradient headers, modern styling
Provider Version Columns: “Latest Version” and “Status” for all providers
Color-Coded Status: Green (Current), Red (Outdated), Yellow (Unknown)
Responsive Layout: Works on desktop, tablet, and mobile
Print Optimization: Perfect for PDF generation

JSON Reports for Automation

thothctl inventory iac --check-versions --report-type json

Features:

Structured data for CI/CD integration
Provider version statistics
Component and module details
Programmatic analysis support

Combined Reports

thothctl inventory iac --check-versions --report-type all

Generates both modern HTML and JSON reports for comprehensive documentation and automation.

Quick Start Examples

Basic Infrastructure Audit

thothctl inventory iac --check-versions

What it does:

✅ Scans all IaC files in the current directory
✅ Checks latest versions for modules and providers
✅ Generates modern HTML report with professional styling
✅ Shows version status and recommendations

Comprehensive Analysis

thothctl inventory iac \
  --check-versions \
  --report-type all \
  --project-name "Production Infrastructure" \
  --inventory-path ./docs/infrastructure

What it does:

✅ Complete version analysis for modules and providers
✅ Generates both HTML and JSON reports
✅ Uses custom project name for professional presentation
✅ Saves reports in organized directory structure

CI/CD Integration

thothctl inventory iac \
  --check-versions \
  --report-type json \
  --inventory-path ./reports/$(date +%Y-%m-%d)

What it does:

✅ Automated inventory creation for pipelines
✅ JSON output for programmatic analysis
✅ Date-organized report storage
✅ Version tracking for compliance

Use Cases

1. Infrastructure Auditing 📊

thothctl inventory iac --check-versions --report-type all

Benefits:

Identify outdated modules and providers
Generate professional reports for stakeholders
Track infrastructure composition over time
Support compliance and security audits

2. Documentation Generation 📚

thothctl inventory iac \
  --check-versions \
  --project-name "Infrastructure Documentation" \
  --report-type html

Benefits:

Modern, professional documentation
Comprehensive component information
Version status and recommendations
Suitable for business presentations

3. Version Management 🔄

thothctl inventory iac --check-versions --report-type json

Benefits:

Identify components needing updates
Track version drift over time
Support automated update workflows
Maintain infrastructure currency

4. Compliance and Security 🔒

thothctl inventory iac \
  --check-versions \
  --complete \
  --report-type all

Benefits:

Security audits through version analysis
Compliance reporting with comprehensive data
Risk assessment for outdated components
Professional documentation for auditors

Best Practices

1. Regular Inventory Creation

# Weekly infrastructure health check
thothctl inventory iac --check-versions

2. Professional Documentation

# Generate business-ready reports
thothctl inventory iac \
  --check-versions \
  --project-name "$(basename $(pwd)) Infrastructure - $(date +%B\ %Y)" \
  --report-type html

3. Automation Integration

# CI/CD pipeline integration
thothctl inventory iac \
  --check-versions \
  --report-type json \
  --inventory-path ./reports/$(date +%Y-%m-%d)

4. Comprehensive Analysis

# Monthly comprehensive audit
thothctl inventory iac \
  --check-versions \
  --complete \
  --report-type all \
  --project-name "Monthly Infrastructure Audit"

Migration Guide

From Old Flags (Deprecated)

# Old approach with redundant flags
thothctl inventory iac --check-providers --check-provider-versions --check-versions

To New Unified Approach (Recommended)

# New simplified approach
thothctl inventory iac --check-versions

Benefits:

✅ Single flag for all version checking
✅ Automatic provider analysis when needed
✅ Simplified user experience
✅ Maintained functionality
✅ Modern reporting

Advanced Features

Provider Tool Selection

# Use OpenTofu (recommended for modern workflows)
thothctl inventory iac --check-versions --provider-tool tofu

# Use Terraform (for legacy workflows)
thothctl inventory iac --check-versions --provider-tool terraform

Complete Analysis

# Include normally excluded directories
thothctl inventory iac --check-versions --complete

Custom Output Organization

# Organized by environment and date
thothctl inventory iac \
  --check-versions \
  --inventory-path ./reports/production/$(date +%Y-%m) \
  --project-name "Production Infrastructure - $(date +%B\ %Y)"

v0.25.0 — CDK Construct Inventory

Starting with v0.25.0, thothctl inventory iac --check-versions supports AWS CDK projects (TypeScript and Python). CDK projects are auto-detected when a cdk.json file is present in the project root.

How It Works

Language	Parsed Files	Registry
TypeScript	`package.json` + `package-lock.json`	npm registry
Python	`requirements.txt` / `pyproject.toml`	PyPI

ThothCTL identifies CDK construct libraries (e.g., aws-cdk-lib, cdk-nag, @aws-cdk/aws-lambda-python-alpha) and checks the upstream registry for the latest published version and release date.

Usage

# In a CDK project directory (cdk.json present)
thothctl inventory iac --check-versions

Example Output

📦 CDK Construct Inventory — my-cdk-app

  Package                        Current    Latest     Status     Released
  ─────────────────────────────────────────────────────────────────────────
  aws-cdk-lib                    2.140.0    2.155.0    Outdated   2026-07-15
  cdk-nag                        2.28.0     2.34.1     Outdated   2026-06-20
  constructs                     10.3.0     10.3.0     Current    2026-05-01
  @aws-cdk/aws-lambda-python-alpha  2.140.0-alpha.0  2.155.0-alpha.0  Outdated  2026-07-15
  @myorg/cdk-patterns            1.5.0      —          Internal   —

✅ 3 outdated · 1 current · 1 internal (skipped)

Internal / Org-Scoped Packages

Packages with internal or organization scopes (e.g., @myorg/cdk-patterns) are detected and listed in the inventory but are not version-checked against a public registry. They appear with status Internal.

Release Dates

For every package checked against npm or PyPI, the release date of the latest version is fetched and displayed. This helps teams assess how far behind they are in calendar time, not just version numbers.

Report Integration

CDK inventory data flows into the same report pipeline:

HTML reports include a CDK constructs section with version badges
JSON reports include CDK components in the standard structure
CycloneDX SBOM maps CDK constructs using the pkg:npm/ or pkg:pypi/ PURL scheme

v0.19.0 Changes

📦 CycloneDX 1.6 SBOM Generation

Starting with v0.19.0, a CycloneDX 1.6 SBOM is always generated alongside HTML and JSON reports. This provides a standardized Software Bill of Materials for your infrastructure components.

# SBOM is automatically generated with every inventory run
thothctl inventory iac --check-versions

CycloneDX SBOM includes:

Section	Content
Formulation	IaC toolchain (Terraform/OpenTofu version, provider versions)
Lifecycles	Build and deploy lifecycle phases
Evidence	Source-code-analysis proof of component usage
Standards	Organizational IaC policies (`org-iac-policies`)
Attestations	Tech debt indicators and version currency
Dependencies	Full DAG (Directed Acyclic Graph) of module relationships
Hashes	SHA-256 integrity verification for all components
Licenses	Inferred license information (MPL-2.0, Apache-2.0)

Package URL format: All components use the pkg:terraform/ PURL scheme for standard identification.

Compatible SBOM consumers:

Dependency-Track — continuous SBOM analysis and vulnerability monitoring
Grype — vulnerability scanning against SBOMs
Trivy — comprehensive security scanner with SBOM ingestion

📁 Updated Report Paths

Reports are now organized under Reports/inventory/ for cleaner project structure:

Reports/
└── inventory/
    ├── html_reports/
    │   └── InventoryIaC_<project>_<date>.html
    ├── InventoryIaC_<project>_<date>.json
    └── InventoryIaC_cyclonedx_<project>_<date>.json

Report Type	Path
HTML	`Reports/inventory/html_reports/`
JSON	`Reports/inventory/InventoryIaC_*.json`
CycloneDX SBOM	`Reports/inventory/InventoryIaC_cyclonedx_*.json`

Migration note: Reports previously written to Reports/ root are now placed in Reports/inventory/. The --inventory-path default is ./Reports.

📊 Dashboard Integration

The inventory integrates with the ThothCTL web dashboard for interactive exploration:

# Launch the dashboard
thothctl dashboard launch

Inventory Tab:

Stack groups overview with component counts
Full-text search across all inventory items
Status filter (Current, Outdated, Unknown)
Click-through to detailed component information

SBOM Details Tab:

Full CycloneDX 1.6 metadata viewer
Interactive dependency graph visualization
License and attestation summaries
Hash verification status for all components

# Generate inventory then explore in dashboard
thothctl inventory iac --check-versions
thothctl dashboard launch

Troubleshooting

Common Issues

No Components Found: Ensure you’re in a directory with IaC files
Version Check Failures: Verify internet connectivity and module accessibility
Provider Analysis Issues: Ensure provider tools are installed and initialized
Report Generation Problems: Check write permissions to output directory

Getting Help

# Detailed command help
thothctl inventory iac --help

# Debug mode for troubleshooting
thothctl --debug inventory iac --check-versions

Summary

The ThothCTL inventory commands now provide:

🎯 Unified Experience: Single --check-versions flag for comprehensive analysis
🎨 Modern Reports: Professional HTML styling suitable for business use
📊 Enhanced Analysis: Provider version tracking with status indicators
🚀 Intelligent Automation: Automatic provider checking when needed
📱 Responsive Design: Multi-device compatibility
🔧 Simplified Interface: Reduced complexity with maintained functionality

Recommended command for most users:

thothctl inventory iac --check-versions

This provides comprehensive analysis with modern reporting in a single, simple command.

This site is open source. Improve this page.