GoogleCloudPlatform/terraformer

terraformer

يقرأ terraformer بنية تديرها ويكتب Terraform. هذه الصفحة لا تصف أخذ بيانات اعتماد.

14,543·15 أكتوبر 2026GoApache-2.0

Terraformer

This project is no longer maintained and is deprecated.

As of March 16, 2026, this repository has been archived. It is now read-only, and no further updates, security patches, or support will be provided.

A CLI tool that generates tf/json and tfstate files based on existing infrastructure
(reverse Terraform).

Disclaimer: This is not an official Google product
Created by: Waze SRE

Demo GCP
Capabilities
Installation
Supported Providers
- Major Cloud
  - Google Cloud
  - AWS
  - Azure
  - AliCloud
  - IBM Cloud
- Cloud
  - DigitalOcean
  - Equinix Metal
  - Fastly
  - Heroku
  - LaunchDarkly
  - Linode
  - NS1
  - OpenStack
  - TencentCloud
  - Vultr
  - Yandex Cloud
  - Ionos Cloud
- Infrastructure Software
- Network
  - Cloudflare (broken, see #1761)
  - Myrasec
  - PAN-OS
- VCS
- Monitoring & System Management
  - Datadog
  - New Relic
  - Mackerel
  - PagerDuty
  - Opsgenie
  - Honeycomb.io
  - Opal
- Community
  - Keycloak
  - Logz.io
  - Commercetools
  - Mikrotik
  - Xen Orchestra
  - GmailFilter
  - Grafana
  - Vault
- Identity
  - Okta
  - Auth0
  - AzureAD
Contributing
Developing
Infrastructure
Stargazers over time

Demo GCP

Capabilities

Generate tf/json + tfstate files from existing infrastructure for all
supported objects by resource.
Remote state can be uploaded to a GCS bucket.
Connect between resources with terraform_remote_state (local and bucket).
Save tf/json files using a custom folder tree pattern.
Import by resource name and type.
Support terraform 0.13 (for terraform 0.11 use v0.7.9).

Terraformer uses Terraform providers and is designed to easily support newly added resources.
To upgrade resources with new fields, all you need to do is upgrade the relevant Terraform providers.

Import current state to Terraform configuration from a provider

Usage:
   import [provider] [flags]
   import [provider] [command]

Available Commands:
  list        List supported resources for a provider

Flags:
  -b, --bucket string         gs://terraform-state
  -c, --connect                (default true)
  -С, --compact                (default false)
  -x, --excludes strings      firewalls,networks
  -f, --filter strings        compute_firewall=id1:id2:id4
  -h, --help                  help for google
  -O, --output string         output format hcl or json (default "hcl")
  -o, --path-output string     (default "generated")
  -p, --path-pattern string   {output}/{provider}/ (default "{output}/{provider}/{service}/")
      --projects strings
  -z, --regions strings       europe-west1, (default [global])
  -r, --resources strings     firewall,networks or * for all services
  -s, --state string          local or bucket (default "local")
  -v, --verbose               verbose mode
  -n, --retry-number          number of retries to perform if refresh fails
  -m, --retry-sleep-ms        time in ms to sleep between retries

Use " import [provider] [command] --help" for more information about a command.

Permissions

The tool requires read-only permissions to list service resources.

Resources

You can use --resources parameter to tell resources from what service you want to import.

To import resources from all services, use --resources="*" . If you want to exclude certain services, you can combine the parameter with --excludes to exclude resources from services you don't want to import e.g. --resources="*" --excludes="iam".

Filtering

Filters are a way to choose which resources terraformer imports. It's possible to filter resources by its identifiers or attributes. Multiple filtering values are separated by :. If an identifier contains this symbol, value should be wrapped in ' e.g. --filter=resource=id1:'project:dataset_id'. Identifier based filters will be executed before Terraformer will try to refresh remote state.

Use Type when you need to filter only one of several types of resources. Multiple filters can be combined when importing different resource types. An example would be importing all AWS security groups from a specific AWS VPC:

terraformer import aws -r sg,vpc --filter Type=sg;Name=vpc_id;Value=VPC_ID --filter Type=vpc;Name=id;Value=VPC_ID

Notice how the Name is different for sg than it is for vpc.

Migration state version

For terraform >= 0.13, you can use replace-provider to migrate state from previous versions.

Example usage:

terraform state replace-provider -auto-approve "registry.terraform.io/-/aws" "hashicorp/aws"

Resource ID

Filtering is based on Terraform resource ID patterns. To find valid ID patterns for your resource, check the import part of the Terraform documentation.

Example usage:

terraformer import aws --resources=vpc,subnet --filter=vpc=myvpcid --regions=eu-west-1

Will only import the vpc with id myvpcid. This form of filters can help when it's necessary to select resources by its identifiers.

Field name only

It is possible to filter by specific field name only. It can be used e.g. when you want to retrieve resources only with a specific tag key.

Example usage:

terraformer import aws --resources=s3 --filter="Name=tags.Abc" --regions=eu-west-1

Will only import the s3 resources that have tag Abc. This form of filters can help when the field values are not important from filtering perspective.

Field with dots

It is possible to filter by a field that contains a dot.

Example usage:

terraformer import aws --resources=s3 --filter="Name=tags.Abc.def" --regions=eu-west-1

Will only import the s3 resources that have tag Abc.def.

Planning

The plan command generates a planfile that contains all the resources set to be imported. By modifying the planfile before running the import command, you can rename or filter the resources you'd like to import.

The rest of subcommands and parameters are identical to the import command.

$ terraformer plan google --resources=networks,firewall --projects=my-project --regions=europe-west1-d
(snip)

Saving planfile to generated/google/my-project/terraformer/plan.json

After reviewing/customizing the planfile, begin the import by running import plan.

$ terraformer import plan generated/google/my-project/terraformer/plan.json

Resource structure

Terraformer by default separates each resource into a file, which is put into a given service directory.

The default path for resource files is {output}/{provider}/{service}/{resource}.tf and can vary for each provider.

It's possible to adjust the generated structure by:

Using --compact parameter to group resource files within a single service into one resources.tf file
Adjusting the --path-pattern parameter and passing e.g. --path-pattern {output}/{provider}/ to generate resources for all services in one directory

It's possible to combine --compact --path-pattern parameters together.

Installation

Both Terraformer and a Terraform provider plugin need to be installed.

Terraformer

From a package manager

Homebrew users can use brew install terraformer.
MacPorts users can use sudo port install terraformer.
Chocolatey users can use choco install terraformer.

From releases
This installs all providers, set PROVIDER to one of google, aws or kubernetes if you only need one.

Linux

export PROVIDER=all
curl -LO "https://github.com/GoogleCloudPlatform/terraformer/releases/download/$(curl -s https://api.github.com/repos/GoogleCloudPlatform/terraformer/releases/latest | grep tag_name | cut -d '"' -f 4)/terraformer-${PROVIDER}-linux-amd64"
chmod +x terraformer-${PROVIDER}-linux-amd64
sudo mv terraformer-${PROVIDER}-linux-amd64 /usr/local/bin/terraformer

MacOS

export PROVIDER=all
curl -LO "https://github.com/GoogleCloudPlatform/terraformer/releases/download/$(curl -s https://api.github.com/repos/GoogleCloudPlatform/terraformer/releases/latest | grep tag_name | cut -d '"' -f 4)/terraformer-${PROVIDER}-darwin-amd64"
chmod +x terraformer-${PROVIDER}-darwin-amd64
sudo mv terraformer-${PROVIDER}-darwin-amd64 /usr/local/bin/terraformer

Windows

Install Terraform - https://www.terraform.io/downloads
Download exe file for required provider from here - https://github.com/GoogleCloudPlatform/terraformer/releases
Add the exe file path to path variable

From source

Run git clone <terraformer repo> && cd terraformer/
Run go mod download
Run go build -v for all providers OR build with one provider
go run build/main.go {google,aws,azure,kubernetes,etc}

Terraform Providers

Create a working folder and initialize the Terraform provider plugin. This folder will be where you run Terraformer commands.

Run terraform init against a versions.tf file to install the plugins required for your platform. For example, if you need plugins for the google provider, versions.tf should contain:

terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
    }
  }
  required_version = ">= 0.13"
}

Or, copy your Terraform provider's plugin(s) from the list below to folder ~/.terraform.d/plugins/, as appropriate.

Links to download Terraform provider plugins:

Major Cloud
- Google Cloud provider >2.11.0 - here
- AWS provider >2.25.0 - here
- Azure provider >1.35.0 - here
- Alicloud provider >1.57.1 - here
Cloud
- DigitalOcean provider >1.9.1 - here
- Heroku provider >2.2.1 - here
- LaunchDarkly provider >=2.1.1 - here
- Linode provider >1.8.0 - here
- OpenStack provider >1.21.1 - here
- TencentCloud provider >1.50.0 - here
- Vultr provider >1.0.5 - here
- Yandex provider >0.42.0 - here
- Ionoscloud provider >6.3.3 - here
Infrastructure Software
- Kubernetes provider >=1.9.0 - here
- RabbitMQ provider >=1.1.0 - here
Network
- Myrasec provider >1.44 - here
- Cloudflare provider >1.16 - here
- Fastly provider >0.16.1 - here
- NS1 provider >1.8.3 - here
- PAN-OS provider >= 1.8.3 - here
VCS
- GitHub provider >=2.2.1 - here
Monitoring & System Management
- Datadog provider >2.1.0 - here
- New Relic provider >2.0.0 - here
- Mackerel provider > 0.0.6 - here
- Pagerduty >=1.9 - here
- Opsgenie >= 0.6.0 here
- Honeycomb.io >= 0.10.0 - here
- Opal >= 0.0.2 - here
Community
- Keycloak provider >=1.19.0 - here
- Logz.io provider >=1.1.1 - here
- Commercetools provider >= 0.21.0 - here
- Mikrotik provider >= 0.2.2 - here
- Xen Orchestra provider >= 0.18.0 - here
- GmailFilter provider >= 1.0.1 - here
- Vault provider - here
- Auth0 provider - here
- AzureAD provider - here

Information on provider plugins:
https://www.terraform.io/docs/configuration/providers.html

High-Level steps to add new provider

Initialize provider details in cmd/root.go and create a provider initialization file in the terraformer/cmd folder
Create a folder under terraformer/providers/ for your provider
Create two files under this folder
- <provide_name>_provider.go
- <provide_name>_service.go
Initialize all provider's supported services in <provide_name>_provider.go file
Create script for each supported service in same folder

Contributing

If you have improvements or fixes, we would love to have your contributions.
Please read CONTRIBUTING.md for more information on the process we would like
contributors to follow.

Developing

Terraformer was built so you can easily add new providers of any kind.

Process for generating tf/json + tfstate files:

Call GCP/AWS/other api and get list of resources.
Iterate over resources and take only the ID (we don't need mapping fields!).
Call to provider for readonly fields.
Call to infrastructure and take tf + tfstate.

Infrastructure

Call to provider using the refresh method and get all data.
Convert refresh data to go struct.
Generate HCL file - tf/json files.
Generate tfstate files.

All mapping of resource is made by providers and Terraform. Upgrades are needed only
for providers.

GCP compute resources

For GCP compute resources, use generated code from
providers/gcp/gcp_compute_code_generator.

To regenerate code:

go run providers/gcp/gcp_compute_code_generator/*.go

Similar projects

terraforming

Terraformer Benefits

Simpler to add new providers and resources - already supports AWS, GCP, GitHub, Kubernetes, and Openstack. Terraforming supports only AWS.
Better support for HCL + tfstate, including updates for Terraform 0.12.
If a provider adds new attributes to a resource, there is no need change Terraformer code - just update the Terraform provider on your laptop.
Automatically supports connections between resources in HCL files.

Comparison

Terraforming gets all attributes from cloud APIs and creates HCL and tfstate files with templating. Each attribute in the API needs to map to attribute in Terraform. Generated files from templating can be broken with illegal syntax. When a provider adds new attributes the terraforming code needs to be updated.

Terraformer instead uses Terraform provider files for mapping attributes, HCL library from Hashicorp, and Terraform code.

Look for S3 support in terraforming here and official S3 support
Terraforming lacks full coverage for resources - as an example you can see that 70% of S3 options are not supported:

terraforming - https://github.com/dtan4/terraforming/blob/master/lib/terraforming/template/tf/s3.erb
official S3 support - https://www.terraform.io/docs/providers/aws/r/s3_bucket

Stargazers over time

Use with AWS

Example:

 terraformer import aws --resources=vpc,subnet --connect=true --regions=eu-west-1 --profile=prod
 terraformer import aws --resources=vpc,subnet --filter=vpc=vpc_id1:vpc_id2:vpc_id3 --regions=eu-west-1

Profiles support

AWS configuration including environmental variables, shared credentials file (~/.aws/credentials), and shared config file (~/.aws/config) will be loaded by the tool by default. To use a specific profile, you can use the following command:

terraformer import aws --resources=vpc,subnet --regions=eu-west-1 --profile=prod

You can also provide no regions when importing resources:

terraformer import aws --resources=cloudfront --profile=prod

In that case terraformer will not know with which region resources are associated with and will not assume any region. That scenario is useful in case of global resources (e.g. CloudFront distributions or Route 53 records) and when region is passed implicitly through environmental variables or metadata service.

Examples to import other resources-

Security Group-

terraformer import aws --resources=sg --regions=us-east-1

Supported services

accessanalyzer
- aws_accessanalyzer_analyzer
acm
- aws_acm_certificate
alb (supports ALB and NLB)
- aws_lb
- aws_lb_listener
- aws_lb_listener_rule
- aws_lb_listener_certificate
- aws_lb_target_group
- aws_lb_target_group_attachment
api_gateway
- aws_api_gateway_authorizer
- aws_api_gateway_api_key
- aws_api_gateway_documentation_part
- aws_api_gateway_gateway_response
- aws_api_gateway_integration
- aws_api_gateway_integration_response
- aws_api_gateway_method
- aws_api_gateway_method_response
- aws_api_gateway_model
- aws_api_gateway_resource
- aws_api_gateway_rest_api
- aws_api_gateway_stage
- aws_api_gateway_usage_plan
- aws_api_gateway_vpc_link
appsync
- aws_appsync_graphql_api
auto_scaling
- aws_autoscaling_group
- aws_launch_configuration
- aws_launch_template
batch
- aws_batch_compute_environment
- aws_batch_job_definition
- aws_batch_job_queue
budgets
- aws_budgets_budget
cloud9
- aws_cloud9_environment_ec2
cloudformation
- aws_cloudformation_stack
- aws_cloudformation_stack_set
- aws_cloudformation_stack_set_instance
cloudfront
- aws_cloudfront_distribution
- aws_cloudfront_cache_policy
cloudhsm
- aws_cloudhsm_v2_cluster
- aws_cloudhsm_v2_hsm
cloudtrail
- aws_cloudtrail
cloudwatch
- aws_cloudwatch_dashboard
- aws_cloudwatch_event_rule
- aws_cloudwatch_event_target
- aws_cloudwatch_metric_alarm
codebuild
- aws_codebuild_project
codecommit
- aws_codecommit_repository
codedeploy
- aws_codedeploy_app
codepipeline
- aws_codepipeline
- aws_codepipeline_webhook
cognito
- aws_cognito_identity_pool
- aws_cognito_user_pool
config
- aws_config_config_rule
- aws_config_configuration_recorder
- aws_config_delivery_channel
customer_gateway
- aws_customer_gateway
datapipeline
- aws_datapipeline_pipeline
devicefarm
- aws_devicefarm_project
docdb
- aws_docdb_cluster
- aws_docdb_cluster_instance
- aws_docdb_cluster_parameter_group
- aws_docdb_subnet_group
dynamodb
- aws_dynamodb_table
ebs
- aws_ebs_volume
- aws_volume_attachment
ec2_instance
- aws_instance
ecr
- aws_ecr_lifecycle_policy
- aws_ecr_repository
- aws_ecr_repository_policy
ecrpublic
- aws_ecrpublic_repository
ecs
- aws_ecs_cluster
- aws_ecs_service
- aws_ecs_task_definition
efs
- aws_efs_access_point
- aws_efs_file_system
- aws_efs_file_system_policy
- aws_efs_mount_target
eip
- aws_eip
eks
- aws_eks_cluster
- aws_eks_node_group
elasticache
- aws_elasticache_cluster
- aws_elasticache_parameter_group
- aws_elasticache_subnet_group
- aws_elasticache_replication_group
elastic_beanstalk
- aws_elastic_beanstalk_application
- aws_elastic_beanstalk_environment
elb
- aws_elb
emr
- aws_emr_cluster
- aws_emr_security_configuration
eni
- aws_network_interface
es
- aws_elasticsearch_domain
firehose
- aws_kinesis_firehose_delivery_stream
glue
- aws_glue_crawler
- aws_glue_catalog_database
- aws_glue_catalog_table
- aws_glue_job
- aws_glue_trigger
iam
- aws_iam_access_key
- aws_iam_group
- aws_iam_group_policy
- aws_iam_group_policy_attachment
- aws_iam_instance_profile
- aws_iam_policy
- aws_iam_role
- aws_iam_role_policy
- aws_iam_role_policy_attachment
- aws_iam_user
- aws_iam_user_group_membership
- aws_iam_user_policy
- aws_iam_user_policy_attachment
igw
- aws_internet_gateway
iot
- aws_iot_thing
- aws_iot_thing_type
- aws_iot_topic_rule
- aws_iot_role_alias
kinesis
- aws_kinesis_stream
kms
- aws_kms_key
- aws_kms_alias
- aws_kms_grant
lambda
- aws_lambda_event_source_mapping
- aws_lambda_function
- aws_lambda_function_event_invoke_config
- aws_lambda_layer_version
- aws_lambda_permission
logs
- aws_cloudwatch_log_group
media_package
- aws_media_package_channel
media_store
- aws_media_store_container
medialive
- aws_medialive_channel
- aws_medialive_input
- aws_medialive_input_security_group
mq
- aws_mq_broker
msk
- aws_msk_cluster
nacl
- aws_network_acl
nat
- aws_nat_gateway
opsworks
- aws_opsworks_application
- aws_opsworks_custom_layer
- aws_opsworks_instance
- aws_opsworks_java_app_layer
- aws_opsworks_php_app_layer
- aws_opsworks_rds_db_instance
- aws_opsworks_stack
- aws_opsworks_static_web_layer
- aws_opsworks_user_profile
organization
- aws_organizations_account
- aws_organizations_organization
- aws_organizations_organizational_unit
- aws_organizations_policy
- aws_organizations_policy_attachment
qldb
- aws_qldb_ledger
rds
- aws_db_instance
- aws_db_proxy
- aws_db_cluster
- aws_db_cluster_snapshot
- aws_db_parameter_group
- aws_db_snapshot
- aws_db_subnet_group
- aws_db_option_group
- aws_db_event_subscription
- aws_rds_global_cluster
redshift
- aws_redshift_cluster
- aws_redshift_event_subscription
- aws_redshift_parameter_group
- aws_redshift_snapshot_schedule
- aws_redshift_snapshot_schedule_association
- aws_redshift_subnet_group
resourcegroups
- aws_resourcegroups_group
route53
- aws_route53_zone
- aws_route53_record
- aws_route53_health_check
route_table
- aws_route_table
- aws_main_route_table_association
- aws_route_table_association
s3
- aws_s3_bucket
secretsmanager
- aws_secretsmanager_secret
securityhub
- aws_securityhub_account
- aws_securityhub_member
- aws_securityhub_standards_subscription
servicecatalog
- aws_servicecatalog_portfolio
ses
- aws_ses_configuration_set
- aws_ses_domain_identity
- aws_ses_email_identity
- aws_ses_receipt_rule
- aws_ses_receipt_rule_set
- aws_ses_template
sfn
- aws_sfn_activity
- aws_sfn_state_machine
sg
- aws_security_group
- aws_security_group_rule (if a rule cannot be inlined)
sns
- aws_sns_topic
- aws_sns_topic_subscription
sqs
- aws_sqs_queue
ssm
- aws_ssm_parameter
subnet
- aws_subnet
swf
- aws_swf_domain
transit_gateway
- aws_ec2_transit_gateway_route_table
- aws_ec2_transit_gateway_vpc_attachment
vpc
- aws_vpc
vpc_endpoint
- aws_vpc_endpoint
vpc_peering
- aws_vpc_peering_connection
vpn_connection
- aws_vpn_connection
vpn_gateway
- aws_vpn_gateway
waf
- aws_waf_byte_match_set
- aws_waf_geo_match_set
- aws_waf_ipset
- aws_waf_rate_based_rule
- aws_waf_regex_match_set
- aws_waf_regex_pattern_set
- aws_waf_rule
- aws_waf_rule_group
- aws_waf_size_constraint_set
- aws_waf_sql_injection_match_set
- aws_waf_web_acl
- aws_waf_xss_match_set
waf_regional
- aws_wafregional_byte_match_set
- aws_wafregional_geo_match_set
- aws_wafregional_ipset
- aws_wafregional_rate_based_rule
- aws_wafregional_regex_match_set
- aws_wafregional_regex_pattern_set
- aws_wafregional_rule
- aws_wafregional_rule_group
- aws_wafregional_size_constraint_set
- aws_wafregional_sql_injection_match_set
- aws_wafregional_web_acl
- aws_wafregional_xss_match_set
wafv2_cloudfront
- aws_wafv2_ip_set
- aws_wafv2_regex_pattern_set
- aws_wafv2_rule_group
- aws_wafv2_web_acl
- aws_wafv2_web_acl_logging_configuration
wafv2_regional
- aws_wafv2_ip_set
- aws_wafv2_regex_pattern_set
- aws_wafv2_rule_group
- aws_wafv2_web_acl
- aws_wafv2_web_acl_association
- aws_wafv2_web_acl_logging_configuration
workspaces
- aws_workspaces_directory
- aws_workspaces_ip_group
- aws_workspaces_workspace
xray
- aws_xray_sampling_rule

Global services

AWS services that are global will be imported without specified region even if several regions will be passed. It is to ensure only one representation of an AWS resource is imported.

List of global AWS services:

budgets
cloudfront
ecrpublic
iam
organization
route53
waf

Attribute filters

Attribute filters allow filtering across different resource types by its attributes.

terraformer import aws --resources=ec2_instance,ebs --filter="Name=tags.costCenter;Value=20000:'20001:1'" --regions=eu-west-1

Will only import AWS EC2 instances along with EBS volumes annotated with tag costCenter with values 20000 or 20001:1. Attribute filters are by default applicable to all resource types although it's possible to specify to what resource type a given filter should be applicable to by providing Type=<type> parameter. For example:

terraformer import aws --resources=ec2_instance,ebs --filter=Type=ec2_instance;Name=tags.costCenter;Value=20000:'20001:1' --regions=eu-west-1

Will work as same as example above with a change the filter will be applicable only to ec2_instance resources.

Few more examples - How to import ec2 instance based on instance name and id

terraformer import aws --resources=ec2_instance --filter="Name=tags.Name;Value=Terraformer" --regions=us-east-1

This command imports ec2 instance having name as Terraformer.

terraformer import aws --resources=ec2_instance --filter="Name=id;Value=i-0xxxxxxxxx" --regions=us-east-1

This command imports ec2 instance having instance-id as i-0xxxxxxxxx.

Due to fact API Gateway generates a lot of resources, it's possible to issue a filtering query to retrieve resources related to a given REST API by tags. To fetch resources related to a REST API resource with a tag STAGE and value dev, add parameter --filter="Type=api_gateway_rest_api;Name=tags.STAGE;Value=dev".

SQS queues retrieval

Terraformer uses AWS ListQueues API call to fetch available queues. The API is able to return only up to 1000 queues and an additional name prefix should be passed to filter the list results. It's possible to pass QueueNamePrefix parameter by environmental variable SQS_PREFIX.

Security groups and rules

Terraformer by default will try to keep rules in security groups as long as no circular dependencies are detected. This approach is implemented to keep the rules as tidy as possible but there can be cases when this behaviour is not desirable (see GoogleCloudPlatform/terraformer#493). To make Terraformer split rules from security groups, add SPLIT_SG_RULES environmental variable with any value.

اقرأ الأصل · README · AWS notes

المستودع

https://github.com/GoogleCloudPlatform/terraformer · المكتبة

terraformer

Terraformer

Table of Contents

Demo GCP

Capabilities

Permissions

Resources

Filtering

Migration state version

Resource ID

Field name only

Field with dots

Planning

Resource structure

Installation

Terraformer

Terraform Providers

High-Level steps to add new provider

Contributing

Developing

Infrastructure

GCP compute resources

Similar projects

terraforming

Terraformer Benefits

Comparison

Stargazers over time

Use with AWS

Profiles support

Supported services

Global services

Attribute filters

SQS queues retrieval

Security groups and rules