Terraclaim
Open Source — MIT License

Claim your AWS estate
as Terraform

Terraclaim scans your AWS account and generates ready-to-use Terraform import {} blocks, resource skeletons, and S3 remote-state backends. No click-ops. No paid tools.

View on GitHub Get started ↓
terraclaim
$ ./terraclaim.sh \
  --regions "us-east-1,eu-west-1" \
  --services "ec2,eks,rds,s3,vpc" \
  --state-bucket my-tf-state-prod \
  --output ./tf-output

Scanning ec2 in us-east-1 ... 24 resources
Scanning eks in us-east-1 ... 3 clusters
Scanning rds in us-east-1 ... 8 instances
Done. Output written to ./tf-output/
Context

Why this is hard — and why most guides get it wrong

The instinct is to think of this as "exporting Terraform." It is not. What you are actually doing is closer to reverse compilation: discovering all resources across accounts and regions, generating Terraform configuration from live infrastructure, reconstructing dependencies, capturing state, and then refactoring everything into something a human can maintain.

The tooling is older than it appears

Terraformer, the tool most guides recommend, was built by the Waze engineering team and has not had meaningful maintenance in years. It works, but it predates Terraform's native import {} blocks and generates output that needs significant cleanup.

Former2 is primarily a browser-based tool, and the CLI variant is a separate community project with limited coverage. Both are fine for getting a rough baseline, but neither should be your primary strategy in 2026.

AWS was never designed to be reverse-compiled

Resources reference each other in ways that tooling will not always catch. Some services do not map cleanly to Terraform resources no matter what you do.

IAM is particularly brutal — the relationship between roles, policies, attachments, and instance profiles is rarely clean in a lived-in estate. Accept these rough edges going in and you will be far less surprised.

How it works

From live AWS to Terraform in minutes

Terraclaim uses the AWS CLI to discover your resources, then writes the Terraform files needed to bring them under version control — with no manual resource hunting required.

STEP 01

Scan your account

Run the script against one region or sweep an entire organisation across multiple accounts and regions.

STEP 02

Import blocks generated

One import {} block per discovered resource, grouped into per-service directories — ready for Terraform 1.5+.

STEP 03

Auto-populate config

Run terraform plan -generate-config-out=generated.tf in any service dir. Terraform reads live state and writes fully-populated HCL.

STEP 04

Detect drift

Run drift.sh regularly to catch resources created or deleted outside Terraform. Use --apply to patch imports.tf automatically.

Supported services

45+ AWS services covered

All the core services you need to bring a real-world AWS estate under Terraform control.

Compute

ec2ebsecsekslambda

Networking

vpcelbcloudfrontroute53acmtransitgatewayvpcendpoints

Data

rdsdynamodbelasticachemsks3efsopensearchredshiftdocumentdb

Streaming

kinesisfirehose

Integration

sqssnsapigatewayeventbridgestepfunctionsses

Security & Compliance

iamkmssecretsmanagerwafv2configcloudtrailguardduty

Platform & CI/CD

ecrssmcloudwatchbackupcodepipelinecodebuild

Auth

cognito

ETL & Analytics

glue

Storage & Transfer

fsxtransfer
Output

Clean, structured Terraform files

Each service gets its own directory with three files that Terraform can use immediately.

imports.tf

One import {} block per discovered resource.

import {
  to = aws_eks_cluster.cluster_production
  id = "production"
}

import {
  to = aws_rds_instance.db_primary
  id = "prod-postgres-01"
}

backend.tf

S3 remote state configuration and AWS provider block, ready to init.

terraform {
  backend "s3" {
    bucket = "my-tf-state"
    key    = "us-east-1/eks/terraform.tfstate"
    region = "us-east-1"
  }
}

resources.tf

Empty resource skeletons matching every import block — populated by terraform plan -generate-config-out.

resource "aws_eks_cluster" "cluster_production" {
  # populated by terraform plan
  # -generate-config-out=generated.tf
}

Directory structure

Organised by account → region → service for easy navigation.

tf-output/
├── summary.txt
└── 123456789012/
    ├── us-east-1/
    │   ├── ec2/
    │   ├── eks/
    │   └── rds/
    └── eu-west-1/
Drift detection

Stay in sync after day one

Once your Terraform baseline is committed, drift.sh re-scans AWS and diffs the results against your imports.tf files — no AWS Resource Explorer required.

NEW

Resources added outside Terraform

Found in AWS but missing from imports.tf. With --apply, new import {} blocks are appended automatically.

REMOVED

Resources deleted outside Terraform

Present in imports.tf but no longer in AWS. With --apply, stale blocks are commented out with a timestamp.

CI

Run on a schedule

Drop drift.sh into a nightly CI job. Pipe the output to Slack or write it to --report to track drift over time.

Sample drift report

# report only
./drift.sh --output ./tf-output --regions "us-east-1"

# apply changes to imports.tf
./drift.sh --output ./tf-output --regions "us-east-1" --apply

-------------------------------------------------------
NEW  (2 resource(s) found in AWS, not in imports.tf)
  + aws_instance.web_server_new  (id: i-0abc123def456)
  + aws_instance.batch_worker    (id: i-0def789abc012)
REMOVED  (1 resource(s) in imports.tf, no longer in AWS)
  - aws_instance.old_bastion     (id: i-0111222333444)
-------------------------------------------------------
Unchanged:               22
New (not yet imported):   2
Removed (stale):          1
Quickstart

Up and running in four commands

You need the AWS CLI, Terraform 1.5+, jq, and Bash 4+. Then:

1

Clone the repo

git clone https://github.com/andrewbakercloudscale/terraclaim.git
cd terraclaim
chmod +x terraclaim.sh reconcile.sh drift.sh
2

Dry-run to preview resource counts

./terraclaim.sh \
  --regions "us-east-1" \
  --services "ec2,vpc,rds" \
  --dry-run
3

Export with S3 remote state

./terraclaim.sh \
  --regions "us-east-1,eu-west-1" \
  --services "ec2,eks,rds,s3,vpc" \
  --state-bucket my-tf-state-prod \
  --output ./tf-output
4

Populate configuration from live state

cd tf-output/123456789012/us-east-1/eks
terraform init
terraform plan -generate-config-out=generated.tf