Open Source  ·  MIT License

Reverse-engineer your AWS estate
into Terraform

CloudtoRepo scans your AWS account and generates ready-to-use Terraform import {} blocks, resource skeletons, and S3 remote-state backends. No click-ops. No paid tools.

View on GitHub See what it does ↓
cloudtorepo
$ ./cloudtorepo.sh \
  --regions "us-east-1,eu-west-1" \
  --services "ec2,eks,rds,s3,vpc" \
  --state-bucket my-tf-state-prod \
  --output ./tf-output

Scanning ec2 in us-east-1 ... 24 resources
Scanning eks in us-east-1 ... 3 clusters
Scanning rds in us-east-1 ... 8 instances
Done. Output written to ./tf-output/
Where to go

Explore CloudtoRepo

Pick a section — each page covers one part of the story in full detail.

⚡
Getting started

Quickstart

Four commands to go from a fresh clone to fully-populated Terraform files across any region, service set, or AWS account. Includes named profiles, tag filtering, and partial-scan resume.

Go to Quickstart →
🗺️
Coverage

Services & quality

65+ AWS services covered — compute, networking, data, security, AI/ML, and more. Backed by a 112-test BATS suite across 7 suites with zero real credentials needed.

Go to Services →
📖
Commands

Full reference

Complete command reference for all six tools: output files, drift detection, reconcile coverage scoring, Markdown reports, the run automation wrapper, and the import state helper.

Go to Reference →
Context

Why this is hard, and why most guides get it wrong

The instinct is to think of this as "exporting Terraform." It is not. What you are actually doing is closer to reverse compilation: discovering all resources across accounts and regions, generating Terraform configuration from live infrastructure, reconstructing dependencies, capturing state, and then refactoring everything into something a human can maintain.

The tooling is older than it appears

Terraformer, the tool most guides recommend, was built by the Waze engineering team and has not had meaningful maintenance in years. It works, but it predates Terraform's native import {} blocks and generates output that needs significant cleanup.

Former2 is primarily a browser-based tool, and the CLI variant is a separate community project with limited coverage. Both are fine for getting a rough baseline, but neither should be your primary strategy in 2026.

AWS was never designed to be reverse-compiled

Resources reference each other in ways that tooling will not always catch. Some services do not map cleanly to Terraform resources no matter what you do.

IAM is particularly brutal: the relationship between roles, policies, attachments, and instance profiles is rarely clean in a lived-in estate. Accept these rough edges going in and you will be far less surprised.

How it works

From live AWS to Terraform in minutes

CloudtoRepo uses the AWS CLI to discover your resources, then writes the Terraform files needed to bring them under version control, with no manual resource hunting required.

STEP 01

Scan your account

Run the script against one region or sweep an entire organisation across multiple accounts and regions.

STEP 02

Import blocks generated

One import {} block per discovered resource, grouped into per-service directories, ready for Terraform 1.5+.

STEP 03

Auto-populate config

Run terraform plan -generate-config-out=generated.tf in any service dir. Terraform reads live state and writes fully-populated HCL.

STEP 04

Detect drift & report

Run drift.sh regularly to catch resources created or deleted outside Terraform. Use --apply to patch imports.tf, then report.sh to generate a Markdown summary.