former2 VS terraforming

Former2 is a tool that automates the creation of Infrastructure-as-Code (IaC) scripts from existing AWS resources. It utilizes the AWS JavaScript SDK to scan the user’s AWS infrastructure, identifying all available resources. Users can then select from this list which resources they want to include in their IaC outputs. This process simplifies the task of writing IaC scripts, especially for complex environments, by directly converting current AWS configurations into ready-to-use code. Former2 is particularly useful for documenting existing infrastructure or for migrating manually created resources into an IaC framework.

More info: https://github.com/iann0036/former2

You can use tools like https://github.com/cycloidio/terracognita or https://github.com/iann0036/former2 to generate the terraform code for you. Then you can consolidate them and if they are simply the same type of objects with different values then you can use terragrunt to pass values to your terraform module.

I have never tried out this tool, but maybe it's worth checking: you could create all the stuff via AWS Console in a sandbox environment and then try to use former2. Nothing autogenerated will ever be good enough compared to handcrafted, but it should give you a nice starting point without much effort.Such a tool can not be expected to work reliably. Thankfully, you need to cover only classic, foundational services like EC2, ELB, and IAM, so I would expect them to work properly for those use cases.

Author of Former2 here.

I've heard of a few people setting up pipelines that use the CLI with the `ALL` services option to generate inventories of their systems, but the generated template would almost certainly not work out of the box due to:

Not quite: a command line tool is also available: https://github.com/iann0036/former2/blob/master/cli/README.md

Terraforming

I would also strongly recommend an iterative triage process: don't feel that you need to solve everything all once. It's a huge amount of progress if you can get to a stage where you understand the relationships between services, have enough monitoring to identify failures, and can iteratively move services to more granular IAM policies even if it's all still running in one big account. Simply using a tool like terraformer or terraforming to move the manual configuration into an IaC workflow is an accomplishment, especially since it helps you both make changes more confidently and identify where new changes are still being made. Depending on the politics, that last part might be important: you'll be unpopular if you take away everyone's rights but you'll probably have better luck first nudging people to make them using a sensible flow rather than by hand.

Haven't tried this but if I ever find myself in your situation I'll give it a spin https://github.com/dtan4/terraforming

There are a couple of tools to automate creating terraform configuration and prepopulate state from existing resources, like terraforming, terraformer or cf-terraforming. But it is still cumbersome and laborious and in my experience, it's usually way easier to just recreate everything within terraform from scratch wherever that's possible.

🧪 Terraforming export existing AWS resources to Terraform style (tf, tfstate).