search

aws-samples / aws2tf

aws2tf - automates the importing of existing AWS resources into Terraform and outputs the Terraform HCL code.
MIT No Attribution
520 stars 100 forks source link

readme

aws2tf

May 2024 - Try the new Python version!

Test it out with:

./aws2tf.py -t vpc

To see the options use:

./aws2tf.py -h & ./aws2tf.py -l

The documentaiton for this version can be found here

The Python port

A port of this tool to Python is underway, greatly aided by Amazon Q Developer (formerly CodeWhisperer). The Python version will coexist with this version and will gradually replace the bash shell scripts in this codebase. The Python version utilizes the new Terraform v5 method of importing resources, while still dereferencing Terraform addresses and searching for dependencies as aws2tf has always done. It will also be significantly faster, making far fewer calls to Terraform.

This utility 'AWS to Terraform' (aws2tf) reads an AWS Account and generates all the required terraform configuration files (.tf) from each of the composite AWS resources

It also imports the terraform state using a

"terraform import ...." command

And finally runs a

"terraform plan" command

There should hopefully be no subsequent additions or deletions reported by the terraform plan command as all the appropriate terraform configuration files will have have automatically been created.

Requirements & Prerequisites

Optional tooling for security reports (CRITICAL and HIGH issues)

Quickstart guide to using the tool

Running the tool in your local shell (bash) required these steps:

  1. Unzip or clone this git repo into an empty directory
  2. login to the AWS cli (aws configure)
  3. run the tool

Usage Guide

The First Run

To generate the terraform files for an account and stop after a "terraform validate":

./aws2tf.sh -v yes

Or if you have a lot of resources in your accoutn try using -t to restrict the number of resources you scan. So if your interested in a type or group for example: Transit Gateway resources:

./aws2tf.sh -v yes -t tgw
terraform validate
Success! The configuration is valid.

Or there may be some kind of error as trying to test everyone's AWS combinations in advance isn't possible.

If you happen to find one of these errors please open an issue here and paste in the error and it will get fixed.

Once the validation is ok you can remove the -v which then also runs the terraform plan.


To generate the terraform files for an entire AWS account, import the resources and perform a terraform plan:

./aws2tf.sh

*Note this will take some time - consider using a -t filter instead - and the adding resources with a subsequent run using -c and -f - see below.

To extract all AWS account Policies and Roles:

./aws2tf.sh -t iam

To generate the terraform files for an EKS cluster named "mycluster"

./aws2tf.sh -t eks -i mycluster

To add App Mesh resources

./aws2tf.sh -t appmesh -c yes -f yes

The -c yes is used to "continue" from where we left off, The -f yes is the "fast forward" action it skips past blocks of resources that were completed during the last run.

The two used in combination should quickly have your run progressing from where you left off

To get a selection of resources use the -t option The currently supported types are:

To get all the VPC related resources in a particular VPC

./aws2tf.sh -t vpc -i vpc-xxxxxxxxx

To use a specific region and profile

./aws2tf.sh -t vpc -i vpc-xxxxxxxxx -r eu-west-1 -p default

Using the cumulative mode

Cumulative mode allows you to add additional state & terraform files form a previous aws2tf run

If for example you want to get several VPCs you can use the cumulative mode:

To get all the VPC related resources in three particular VPC's

./aws2tf.sh -t vpc -i vpc-aaaaaaaaa 
./aws2tf.sh -t vpc -i vpc-bbbbbbbbb -c yes
./aws2tf.sh -t vpc -i vpc-ccccccccc -c yes


Be patient - lots of output is given as aws2tf:

Terraform State

aws2tf maintains state in it's own local directory:

generated/tf../

When using cumulative mode this same state file is used / added to.

It is not possibel at this time to use your own state location (eg. on s3)

Still under development

To get all the resources in a deployed Stack Set

./aws2tf.sh -s <stack set name>

Please open an issue for any resources you see in the unprocessed.log to help prioritize development

Or simply check back after some time to see if they are listed below.

Terraform resources supported as of 08-Oct-2023

Resources within a Stack Set that can currently be converted to Terraform (-s ) as of 08-Oct-2023