> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fjall.io/llms.txt
> Use this file to discover all available pages before exploring further.
# fjall assets
> Inspect AWS infrastructure assets with the Fjall CLI: list, show, check compliance and summarise your estate.
`fjall assets` reads the asset inventory Fjall builds from scheduled scans of your connected AWS accounts. It queries the Fjall API rather than AWS directly, so it runs from any machine that is logged in.
The command is a dispatcher: the first positional picks the subcommand, the second (where accepted) names the asset.
* **Fjall CLI installed**, running on Node 22 or later.
* **Logged in**: run `fjall login`. Credentials live at `~/.fjall/auth.json` (or `$FJALL_CONFIG_DIR/auth.json`).
* **At least one AWS account connected** with `fjall connect`. Discovery scans connected accounts on a schedule, so a freshly connected account returns no rows until its first scan finishes.
* **Asset management entitlement** (Pro plan or above). Without it every subcommand refuses with `Asset management requires a Pro plan or above.`
## Inspect your asset estate
```bash theme={null}
fjall assets [subcommand] [asset]
```
Omit the subcommand and the CLI runs `list`.
| Subcommand | Alias | Argument | What it returns |
| ------------ | ----- | -------------------------- | ------------------------------------------------ |
| `list` | `ls` | none | One page of assets, newest cursor position first |
| `show` | `get` | asset ID or ARN (required) | Full detail for one asset |
| `compliance` | none | asset ID or ARN (required) | Compliance issues recorded against one asset |
| `summary` | none | none | Estate totals across every page |
Anything else exits with `Unknown subcommand ''` and prints the four canonical names.
### List assets
```bash theme={null}
fjall assets list
fjall assets list --type AWS::S3::Bucket --region eu-west-1
fjall assets list --take 200 --status deleted
```
Each row prints a status icon, name, type and region. The footer prints the row count, and a resume hint when more pages exist.
Paging is cursor-based. Copy the `nextCursor` from the hint and repeat the same filters, because a cursor only continues the listing it was issued for:
```bash theme={null}
fjall assets list --cursor cl9x2k4m0000qwer --type AWS::S3::Bucket --region eu-west-1
```
### Show one asset
```bash theme={null}
fjall assets show arn:aws:s3:::api-uploads-production
fjall assets show cm4h8k2p0000abcd --format json
```
Both the asset ARN and the Fjall record ID work. The ARN is the stable address across servers, so prefer it when scripting.
Detail output covers name, type, provider, region, status, ARN and record ID, plus IaC status, account and estimated monthly cost when the scan recorded them. `iacStatus` is one of `Managed`, `Partial` or `Unmanaged`.
### Check compliance for an asset
```bash theme={null}
fjall assets compliance arn:aws:s3:::api-uploads-production
fjall assets compliance arn:aws:rds:eu-west-1:123456789012:db:web-primary --format json
```
Each issue prints as `[SEVERITY] Title (ruleId)` with a severity icon. `critical` and `high` render as error marks, `medium` as a warning triangle, everything else as a bullet.
This listing returns every recorded issue for the asset, including resolved and suppressed rows. The `openIssues` count available on `assets list` counts only open issues, so the two numbers differ by design.
Take a `ruleId` and issue ID from here into `fjall compliance fix --issue-id --execute` to remediate.
### Summarise the estate
```bash theme={null}
fjall assets summary
fjall assets summary --format json
```
Summary pages the listing to exhaustion rather than reading one window, so the totals count the estate. The sweep includes deleted assets, which is what makes the `Active` and `Deleted` buckets meaningful:
```
Total assets: 412
Active: 389
Deleted: 23
With open issues: 17
```
The sweep is bounded at 20 pages of 5,000 assets. Past that the command fails rather than reporting a partial listing as the estate.
## What happens
**Every subcommand authenticates first.** Login is checked before any query runs, then an advisory entitlement gate reads your plan. If the entitlement read itself fails, the command proceeds and prints a warning rather than assuming you are entitled.
**`assets list` opens the interactive screen when it can.** On a TTY with no `--non-interactive` and no agent mode, the listing renders in the Ink UI and exits to a final-state summary. Piped output, `--non-interactive` and agent mode all take the plain writer instead. `show`, `compliance` and `summary` always use the plain writer.
**Nothing here mutates AWS.** All four subcommands are reads against the Fjall API. There is no dry-run flag because there is nothing to dry-run.
**Filters are applied server-side.** `--type` and `--region` are passed to the assets API as query parameters, so a filtered page is a full page of matches rather than a page filtered after the fact.
**`--status deleted` widens the listing.** It sets `includeDeleted` on the query, returning deleted assets alongside active ones. Any other value, `active` included, leaves the default active-only listing.
**Agent mode emits structured output.** With `--agent` (or auto-detection), results render as TOON blocks with aggregates and a resume cursor rather than a table. `--fields` is validated against the subcommand's schema before authentication, so a typo fails fast with `VALIDATION_ERROR` instead of spending an auth round-trip.
Selectable fields per subcommand:
| Subcommand | Default fields | Extra fields |
| ------------------- | ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `assets list` | `name`, `assetIdentifier`, `type`, `region`, `status` | `id`, `openIssues` |
| `assets show` | `name`, `type`, `region`, `status`, `assetIdentifier`, `provider` | `id`, `accountId`, `iacStatus`, `estimatedMonthlyCost`, `lastSeenAt`, `createdAt`, `updatedAt` |
| `assets compliance` | `issueId`, `title`, `severity`, `status`, `ruleId` | none |
| `assets summary` | `total`, `active`, `deleted`, `withIssues` | none |
Under `--budget compact` only the first two fields of each row survive. `assetIdentifier` sits second on the asset listing and `issueId` first on the compliance listing, so a budgeted result still carries the key you act on.
## Options
### Listing options
These shape `assets list`. `assets summary` runs its own exhaustive sweep and ignores them, as do `show` and `compliance`.
| Flag | Description | Default |
| ------------------- | ---------------------------------------------------- | ----------- |
| `--format ` | Output format (table\|json) | `table` |
| `--status ` | Filter by status (active\|deleted) | active only |
| `--type ` | Filter by asset type (server-side) | unset |
| `--region ` | Filter by region (server-side) | unset |
| `--take ` | Number of results | `50` |
| `--cursor ` | Resume the listing from a previous page's nextCursor | unset |
`--format json` also applies to `show`, `compliance` and `summary`, printing the raw API payload with its warnings attached. `--take` must be a positive integer. The CLI always sends a value, so a bare `fjall assets list` returns 50 rows. The API clamps the value at 10,000 rather than rejecting it.
### Shared flags
Registered on every `fjall` command node.
| Flag | Description |
| ------------------- | ----------------------------------------------- |
| `--non-interactive` | Force plain CLI output (no UI) |
| `-v, --verbose` | Enable verbose output |
| `--agent` | Enable agent output mode |
| `--budget ` | Output budget: minimal, compact, or token count |
| `--fields ` | Select exactly these output fields |
| `--full` | Disable content truncation |
`--no-agent` is a root-level global that disables agent mode even when auto-detection would enable it.
## Next Steps
List the resources declared in an application's infrastructure.ts
Detect and repair drift between declared and deployed infrastructure
Connect an AWS account so discovery can scan it
Structured output, field selection and budgets for AI agents