v1.1.7

🚨 If you encounter any bugs or have suggestions, please report them here.

Changes since v1.1.6

What's Changed

Infrastructure-as-Code state scan (new)

• Assess a Terraform or OpenTofu state file with --tfstate. A second input source alongside the live cloud APIs: point the CLI at a local state file and it builds the resource inventory by parsing it — no credentials, no API calls, nothing leaves your machine. Available on both the aws and azure subcommands, and through --config via providerDetails.tfstatePath.

  python3 main.py aws --tfstate infra.tfstate
  python3 main.py azure --tfstate infra.tfstate

• OpenTofu works identically. Terraform (≥ 0.12) and every OpenTofu release write state format version 4, which is what the parser reads. Older v1–v3 states are rejected with an explicit message pointing at terraform state pull for remote backends.

• Accurate counts for count and for_each. Every instance of every managed resource is counted individually, so expansions are exact. Data sources are ignored.

• Instance attributes are never written to disk. State files hold generated passwords, connection strings, and keys in plain text. Only a resource's address, type, location, and count ever leave the state. In place of the raw API dump written by live assessments, state scans write raw_data/tfstate_manifest.json — addresses, types, locations, and counts only.

• Credential, permission, and cost steps are skipped explicitly. Each is reported as a skipped step rather than silently omitted, and reports render with an empty cost inventory. Risk assessment and report generation are unchanged.

• Mismatched and mixed states are caught. A state holding no resources for the selected provider fails rather than producing a plausible-looking empty report, and names the other subcommand. A state holding several providers assesses only the one you selected and reports how many resources were excluded.

• --egress is rejected with --tfstate. Egress estimation needs live API access: most data volumes come from CloudWatch and Azure Monitor metrics a state file cannot supply, and a partial estimate covering only provisioned disks would understate the real figure.

• Credential fields are rejected next to tfstatePath. --profile, --cli, and --config were already mutually exclusive with --tfstate; configuration files now follow the same rule, so credentials can't be silently ignored by a state-file run.

Internal

• New core/utils_tfstate.py covering state parsing, resource extraction, location resolution, and manifest generation, with the region resolved from an explicit region/location attribute or, failing that, from the resource's own ARN. Referenced ARNs such as stream_arn are deliberately never read — they can point at another region or account.
• Test coverage for the new module plus the report scope section, config validation, and empty-cost report generation.