Skip to main content
fjall assets reads the asset inventory Fjall builds from scheduled scans of your connected AWS accounts. It queries the Fjall API rather than AWS directly, so it runs from any machine that is logged in. The command is a dispatcher: the first positional picks the subcommand, the second (where accepted) names the asset.
  • Fjall CLI installed, running on Node 22 or later.
  • Logged in: run fjall login. Credentials live at ~/.fjall/auth.json (or $FJALL_CONFIG_DIR/auth.json).
  • At least one AWS account connected with fjall connect. Discovery scans connected accounts on a schedule, so a freshly connected account returns no rows until its first scan finishes.
  • Asset management entitlement (Pro plan or above). Without it every subcommand refuses with Asset management requires a Pro plan or above.

​
Inspect your asset estate

Omit the subcommand and the CLI runs list. Anything else exits with Unknown subcommand '<name>' and prints the four canonical names.

​
List assets

Each row prints a status icon, name, type and region. The footer prints the row count, and a resume hint when more pages exist. Paging is cursor-based. Copy the nextCursor from the hint and repeat the same filters, because a cursor only continues the listing it was issued for:

​
Show one asset

Both the asset ARN and the Fjall record ID work. The ARN is the stable address across servers, so prefer it when scripting. Detail output covers name, type, provider, region, status, ARN and record ID, plus IaC status, account and estimated monthly cost when the scan recorded them. iacStatus is one of Managed, Partial or Unmanaged.

​
Check compliance for an asset

Each issue prints as [SEVERITY] Title (ruleId) with a severity icon. critical and high render as error marks, medium as a warning triangle, everything else as a bullet. This listing returns every recorded issue for the asset, including resolved and suppressed rows. The openIssues count available on assets list counts only open issues, so the two numbers differ by design. Take a ruleId and issue ID from here into fjall compliance fix --issue-id <id> --execute to remediate.

​
Summarise the estate

Summary pages the listing to exhaustion rather than reading one window, so the totals count the estate. The sweep includes deleted assets, which is what makes the Active and Deleted buckets meaningful:
The sweep is bounded at 20 pages of 5,000 assets. Past that the command fails rather than reporting a partial listing as the estate.

​
What happens

Every subcommand authenticates first. Login is checked before any query runs, then an advisory entitlement gate reads your plan. If the entitlement read itself fails, the command proceeds and prints a warning rather than assuming you are entitled. assets list opens the interactive screen when it can. On a TTY with no --non-interactive and no agent mode, the listing renders in the Ink UI and exits to a final-state summary. Piped output, --non-interactive and agent mode all take the plain writer instead. show, compliance and summary always use the plain writer. Nothing here mutates AWS. All four subcommands are reads against the Fjall API. There is no dry-run flag because there is nothing to dry-run. Filters are applied server-side. --type and --region are passed to the assets API as query parameters, so a filtered page is a full page of matches rather than a page filtered after the fact. --status deleted widens the listing. It sets includeDeleted on the query, returning deleted assets alongside active ones. Any other value, active included, leaves the default active-only listing. Agent mode emits structured output. With --agent (or auto-detection), results render as TOON blocks with aggregates and a resume cursor rather than a table. --fields is validated against the subcommand’s schema before authentication, so a typo fails fast with VALIDATION_ERROR instead of spending an auth round-trip. Selectable fields per subcommand:
Under --budget compact only the first two fields of each row survive. assetIdentifier sits second on the asset listing and issueId first on the compliance listing, so a budgeted result still carries the key you act on.

​
Options

​
Listing options

These shape assets list. assets summary runs its own exhaustive sweep and ignores them, as do show and compliance. --format json also applies to show, compliance and summary, printing the raw API payload with its warnings attached. --take must be a positive integer. The CLI always sends a value, so a bare fjall assets list returns 50 rows. The API clamps the value at 10,000 rather than rejecting it.

​
Shared flags

Registered on every fjall command node. --no-agent is a root-level global that disables agent mode even when auto-detection would enable it.

​
Next Steps

fjall list

List the resources declared in an application’s infrastructure.ts

fjall drift

Detect and repair drift between declared and deployed infrastructure

fjall connect

Connect an AWS account so discovery can scan it

Agent mode

Structured output, field selection and budgets for AI agents