docs/aws.md
Example:
terraformer import aws --resources=vpc,subnet --connect=true --regions=eu-west-1 --profile=prod
terraformer import aws --resources=vpc,subnet --filter=vpc=vpc_id1:vpc_id2:vpc_id3 --regions=eu-west-1
AWS configuration including environmental variables, shared credentials file (~/.aws/credentials), and shared config file (~/.aws/config) will be loaded by the tool by default. To use a specific profile, you can use the following command:
terraformer import aws --resources=vpc,subnet --regions=eu-west-1 --profile=prod
You can also provide no regions when importing resources:
terraformer import aws --resources=cloudfront --profile=prod
In that case terraformer will not know with which region resources are associated with and will not assume any region. That scenario is useful in case of global resources (e.g. CloudFront distributions or Route 53 records) and when region is passed implicitly through environmental variables or metadata service.
Examples to import other resources-
terraformer import aws --resources=sg --regions=us-east-1
accessanalyzer
aws_accessanalyzer_analyzeracm
aws_acm_certificatealb (supports ALB and NLB)
aws_lbaws_lb_listeneraws_lb_listener_ruleaws_lb_listener_certificateaws_lb_target_groupaws_lb_target_group_attachmentapi_gateway
aws_api_gateway_authorizeraws_api_gateway_api_keyaws_api_gateway_documentation_partaws_api_gateway_gateway_responseaws_api_gateway_integrationaws_api_gateway_integration_responseaws_api_gateway_methodaws_api_gateway_method_responseaws_api_gateway_modelaws_api_gateway_resourceaws_api_gateway_rest_apiaws_api_gateway_stageaws_api_gateway_usage_planaws_api_gateway_vpc_linkappsync
aws_appsync_graphql_apiauto_scaling
aws_autoscaling_groupaws_launch_configurationaws_launch_templatebatch
aws_batch_compute_environmentaws_batch_job_definitionaws_batch_job_queuebudgets
aws_budgets_budgetcloud9
aws_cloud9_environment_ec2cloudformation
aws_cloudformation_stackaws_cloudformation_stack_setaws_cloudformation_stack_set_instancecloudfront
aws_cloudfront_distributionaws_cloudfront_cache_policycloudhsm
aws_cloudhsm_v2_clusteraws_cloudhsm_v2_hsmcloudtrail
aws_cloudtrailcloudwatch
aws_cloudwatch_dashboardaws_cloudwatch_event_ruleaws_cloudwatch_event_targetaws_cloudwatch_metric_alarmcodebuild
aws_codebuild_projectcodecommit
aws_codecommit_repositorycodedeploy
aws_codedeploy_appcodepipeline
aws_codepipelineaws_codepipeline_webhookcognito
aws_cognito_identity_poolaws_cognito_user_poolconfig
aws_config_config_ruleaws_config_configuration_recorderaws_config_delivery_channelcustomer_gateway
aws_customer_gatewaydatapipeline
aws_datapipeline_pipelinedevicefarm
aws_devicefarm_projectdocdb
aws_docdb_clusteraws_docdb_cluster_instanceaws_docdb_cluster_parameter_groupaws_docdb_subnet_groupdynamodb
aws_dynamodb_tableebs
aws_ebs_volumeaws_volume_attachmentec2_instance
aws_instanceecr
aws_ecr_lifecycle_policyaws_ecr_repositoryaws_ecr_repository_policyecrpublic
aws_ecrpublic_repositoryecs
aws_ecs_clusteraws_ecs_serviceaws_ecs_task_definitionefs
aws_efs_access_pointaws_efs_file_systemaws_efs_file_system_policyaws_efs_mount_targeteip
aws_eipeks
aws_eks_clusteraws_eks_node_groupelasticache
aws_elasticache_clusteraws_elasticache_parameter_groupaws_elasticache_subnet_groupaws_elasticache_replication_groupelastic_beanstalk
aws_elastic_beanstalk_applicationaws_elastic_beanstalk_environmentelb
aws_elbemr
aws_emr_clusteraws_emr_security_configurationeni
aws_network_interfacees
aws_elasticsearch_domainfirehose
aws_kinesis_firehose_delivery_streamglue
aws_glue_crawleraws_glue_catalog_databaseaws_glue_catalog_tableaws_glue_jobaws_glue_triggeriam
aws_iam_access_keyaws_iam_groupaws_iam_group_policyaws_iam_group_policy_attachmentaws_iam_instance_profileaws_iam_policyaws_iam_roleaws_iam_role_policyaws_iam_role_policy_attachmentaws_iam_useraws_iam_user_group_membershipaws_iam_user_policyaws_iam_user_policy_attachmentigw
aws_internet_gatewayiot
aws_iot_thingaws_iot_thing_typeaws_iot_topic_ruleaws_iot_role_aliaskinesis
aws_kinesis_streamkms
aws_kms_keyaws_kms_aliasaws_kms_grantlambda
aws_lambda_event_source_mappingaws_lambda_functionaws_lambda_function_event_invoke_configaws_lambda_layer_versionaws_lambda_permissionlogs
aws_cloudwatch_log_groupmedia_package
aws_media_package_channelmedia_store
aws_media_store_containermedialive
aws_medialive_channelaws_medialive_inputaws_medialive_input_security_groupmq
aws_mq_brokermsk
aws_msk_clusternacl
aws_network_aclnat
aws_nat_gatewayopsworks
aws_opsworks_applicationaws_opsworks_custom_layeraws_opsworks_instanceaws_opsworks_java_app_layeraws_opsworks_php_app_layeraws_opsworks_rds_db_instanceaws_opsworks_stackaws_opsworks_static_web_layeraws_opsworks_user_profileorganization
aws_organizations_accountaws_organizations_organizationaws_organizations_organizational_unitaws_organizations_policyaws_organizations_policy_attachmentqldb
aws_qldb_ledgerrds
aws_db_instanceaws_db_proxyaws_db_clusteraws_db_cluster_snapshotaws_db_parameter_groupaws_db_snapshotaws_db_subnet_groupaws_db_option_groupaws_db_event_subscriptionaws_rds_global_clusterredshift
aws_redshift_clusteraws_redshift_event_subscriptionaws_redshift_parameter_groupaws_redshift_snapshot_scheduleaws_redshift_snapshot_schedule_associationaws_redshift_subnet_groupresourcegroups
aws_resourcegroups_grouproute53
aws_route53_zoneaws_route53_recordaws_route53_health_checkroute_table
aws_route_tableaws_main_route_table_associationaws_route_table_associations3
aws_s3_bucketsecretsmanager
aws_secretsmanager_secretsecurityhub
aws_securityhub_accountaws_securityhub_memberaws_securityhub_standards_subscriptionservicecatalog
aws_servicecatalog_portfolioses
aws_ses_configuration_setaws_ses_domain_identityaws_ses_email_identityaws_ses_receipt_ruleaws_ses_receipt_rule_setaws_ses_templatesfn
aws_sfn_activityaws_sfn_state_machinesg
aws_security_groupaws_security_group_rule (if a rule cannot be inlined)sns
aws_sns_topicaws_sns_topic_subscriptionsqs
aws_sqs_queuessm
aws_ssm_parametersubnet
aws_subnetswf
aws_swf_domaintransit_gateway
aws_ec2_transit_gateway_route_tableaws_ec2_transit_gateway_vpc_attachmentvpc
aws_vpcvpc_endpoint
aws_vpc_endpointvpc_peering
aws_vpc_peering_connectionvpn_connection
aws_vpn_connectionvpn_gateway
aws_vpn_gatewaywaf
aws_waf_byte_match_setaws_waf_geo_match_setaws_waf_ipsetaws_waf_rate_based_ruleaws_waf_regex_match_setaws_waf_regex_pattern_setaws_waf_ruleaws_waf_rule_groupaws_waf_size_constraint_setaws_waf_sql_injection_match_setaws_waf_web_aclaws_waf_xss_match_setwaf_regional
aws_wafregional_byte_match_setaws_wafregional_geo_match_setaws_wafregional_ipsetaws_wafregional_rate_based_ruleaws_wafregional_regex_match_setaws_wafregional_regex_pattern_setaws_wafregional_ruleaws_wafregional_rule_groupaws_wafregional_size_constraint_setaws_wafregional_sql_injection_match_setaws_wafregional_web_aclaws_wafregional_xss_match_setwafv2_cloudfront
aws_wafv2_ip_setaws_wafv2_regex_pattern_setaws_wafv2_rule_groupaws_wafv2_web_aclaws_wafv2_web_acl_logging_configurationwafv2_regional
aws_wafv2_ip_setaws_wafv2_regex_pattern_setaws_wafv2_rule_groupaws_wafv2_web_aclaws_wafv2_web_acl_associationaws_wafv2_web_acl_logging_configurationworkspaces
aws_workspaces_directoryaws_workspaces_ip_groupaws_workspaces_workspacexray
aws_xray_sampling_ruleAWS services that are global will be imported without specified region even if several regions will be passed. It is to ensure only one representation of an AWS resource is imported.
List of global AWS services:
budgetscloudfrontecrpubliciamorganizationroute53wafAttribute filters allow filtering across different resource types by its attributes.
terraformer import aws --resources=ec2_instance,ebs --filter="Name=tags.costCenter;Value=20000:'20001:1'" --regions=eu-west-1
Will only import AWS EC2 instances along with EBS volumes annotated with tag costCenter with values 20000 or 20001:1. Attribute filters are by default applicable to all resource types although it's possible to specify to what resource type a given filter should be applicable to by providing Type=<type> parameter. For example:
terraformer import aws --resources=ec2_instance,ebs --filter=Type=ec2_instance;Name=tags.costCenter;Value=20000:'20001:1' --regions=eu-west-1
Will work as same as example above with a change the filter will be applicable only to ec2_instance resources.
Few more examples - How to import ec2 instance based on instance name and id
terraformer import aws --resources=ec2_instance --filter="Name=tags.Name;Value=Terraformer" --regions=us-east-1
This command imports ec2 instance having name as Terraformer.
terraformer import aws --resources=ec2_instance --filter="Name=id;Value=i-0xxxxxxxxx" --regions=us-east-1
This command imports ec2 instance having instance-id as i-0xxxxxxxxx.
Due to fact API Gateway generates a lot of resources, it's possible to issue a filtering query to retrieve resources related to a given REST API by tags. To fetch resources related to a REST API resource with a tag STAGE and value dev, add parameter --filter="Type=api_gateway_rest_api;Name=tags.STAGE;Value=dev".
Terraformer uses AWS ListQueues API call to fetch available queues. The API is able to return only up to 1000 queues and an additional name prefix should be passed to filter the list results. It's possible to pass QueueNamePrefix parameter by environmental variable SQS_PREFIX.
Terraformer by default will try to keep rules in security groups as long as no circular dependencies are detected. This approach is implemented to keep the rules as tidy as possible but there can be cases when this behaviour is not desirable (see GoogleCloudPlatform/terraformer#493). To make Terraformer split rules from security groups, add SPLIT_SG_RULES environmental variable with any value.