---
title: "complyform scan"
description: "Discover existing Terraform resources from state files or cloud APIs."
---

Discover existing Terraform resources from state files or live cloud APIs.

## Usage

```bash
complyform scan [options]
```

## Options

| Flag | Type | Default | Description |
|---|---|---|---|
| `--source` | `state\|api` | `state` | Scan source: local/remote state file or live cloud API |
| `--state` | path (multi-value) | — | Path to state file. Repeat for multiple. Supports `gs://`, `s3://`, `azure://`, `app.terraform.io/org/ws` |
| `--discover` | path | — | Recursive state file discovery in directory. Mutually exclusive with `--state` and `--batch`. Max 50 files. (SPEC-001) |
| `--discover-pattern` | string | `*.tfstate` | Glob pattern for `--discover` |
| `--project` | string | — | Cloud project ID (for `--source=api`) |
| `--org` | string | — | Org ID — include org-level resources (for `--source=api`) |
| `--cloud` | `gcp\|aws\|azure` | `gcp` | Target cloud provider |
| `--credentials` | path | — | Per-invocation credential override |
| `--batch` | path | — | Batch manifest YAML — up to 10 projects (Agency tier) |
| `--parallel` | int | `1` | Concurrent scans in batch mode (max 5) |
| `--assess` | bool | `false` | Chain scan + assess in one command. Passes through all assess flags. |
| `--frameworks` | string | — | Used with `--assess`: comma-separated framework IDs |

## Examples

Scan a local state file:

```bash
complyform scan --state=terraform.tfstate
```

Scan a remote GCS state file (Pro+):

```bash
complyform scan --state=gs://my-bucket/terraform.tfstate
```

Scan a live GCP project via cloud API (Team+):

```bash
complyform scan --source=api --project=my-gcp-project --cloud=gcp
```

Discover state files in a monorepo (SPEC-001):

```bash
complyform scan --discover=./environments/
```

Chain scan and assess in one command:

```bash
complyform scan --state=terraform.tfstate --assess --frameworks=soc2
```

## Related Commands

- [`assess`](/cli-reference/assess/) — Map scanned resources to framework controls
- [`remediate`](/cli-reference/remediate/) — Generate patches for failing controls
- [`validate`](/cli-reference/validate/) — Confirm patches pass compliance checks
