terraback
Advanced tools
Multi-Cloud Infrastructure as Code Tool
Terraback is an advanced CLI tool that reverse-engineers existing cloud infrastructure into clean, production-ready Terraform code with intelligent dependency discovery.
Transform legacy cloud environments into infrastructure-as-code in minutes, not months.
Core Infrastructure (Community Edition - Free):
Advanced Services (Professional & Enterprise):
AWS Services:
Azure Services:
GCP Services:
The --with-deps flag automatically discovers and maps complete infrastructure stacks:
# AWS Example
terraback ec2 scan --with-deps
# Automatically finds and scans:
# ├── VPC and networking (subnets, security groups)
# ├── Load balancers (ALB, target groups, listeners)
# ├── Storage (EBS volumes, snapshots)
# ├── Security (IAM roles, certificates)
# ├── Monitoring (CloudWatch logs, alarms)
# └── All interconnected dependencies
# Azure Example
terraback vm scan --with-deps
# Automatically finds and scans:
# ├── Virtual Networks and Subnets
# ├── Network Security Groups with rules
# ├── Managed Disks and Snapshots
# ├── Network Interfaces and Public IPs
# ├── Storage Accounts
# └── All interconnected dependencies
Terraback ships an MCP (Model Context Protocol) server so AI agents such as Claude Code, Claude Desktop, Cursor, and Windsurf can import existing cloud infrastructure into Terraform deterministically - no LLM-guessed HCL.
# zero-install trial
uvx terraback mcp
# or wire into Claude Code
claude mcp add terraback -- terraback mcp
Six tools over the same engine as the CLI: scan_infrastructure,
detect_unmanaged, codify_resource, codify_batch, verify_plan, and
list_supported_resources. The verify_plan tool runs a real
terraform plan and returns a parsed drift summary so agents can iterate
until the plan is imports-only. Read-only by design: bring read-only cloud
credentials (AWS ReadOnlyAccess + SecurityAudit, Azure Reader, GCP
roles/viewer); everything runs locally over stdio and nothing transits any
external service. See docs/mcp/README.md for the full tool contract.
aws CLI configuredaz CLI configured and logged ingcloud CLI configuredxxhash for faster cache hashingpip install terraback
Linux/macOS:
# Linux
curl -L https://dist.terraback.dev.io/releases/latest/terraback-linux -o terraback
chmod +x terraback
sudo mv terraback /usr/local/bin/
# macOS
curl -L https://dist.terraback.dev.io/releases/latest/terraback-macos -o terraback
chmod +x terraback
sudo mv terraback /usr/local/bin/
Windows: Download from releases
# Configure AWS credentials (if not already done)
aws configure
# Scan EC2 instances
terraback ec2 scan
# Scan VPC with all dependencies
terraback vpc scan --with-deps
# Scan specific region
terraback ec2 scan --region eu-west-1
# Scan with specific profile
terraback s3 scan --profile production
# Login to Azure (if not already done)
az login
# Scan Virtual Machines
terraback vm scan
# Scan entire resource group
terraback vm scan --resource-group production-rg
# Scan specific subscription
terraback vnet scan --subscription-id YOUR-SUBSCRIPTION-ID
# Scan with location filter
terraback storage scan --location westeurope
# Scan all resources (cloud-specific)
terraback scan-all aws --region us-east-1
terraback scan-all azure --resource-group my-rg
terraback scan-all gcp --region us-central1 --cache-ttl 30
# Check authentication status
terraback auth-check
# Use caching for large infrastructures
terraback scan-recursive ec2 --use-cache --cache-ttl 120
terraback scan-recursive vm --use-cache --parallel-workers 10
After scanning completes, Terraback automatically runs terraform fmt, terraform init and terraform validate on the generated code. Use --skip-check with any scan-all command to bypass this validation step. If you skip the checks, run terraback aws scan-all --check (or python -m terraback.utils.template_syntax_fixer <output_dir>) before invoking terraform init manually.
| Service | Resources | Status |
|---|---|---|
| EC2 | Instances, Volumes, Snapshots, AMIs, Key Pairs, Launch Templates, Network Interfaces | ✅ Full Support |
| VPC | VPCs, Subnets, Security Groups, Internet/NAT Gateways, Route Tables, VPC Endpoints | ✅ Full Support |
| IAM | Roles, Policies, Instance Profiles | ✅ Full Support |
| S3 | Buckets, Versioning, Lifecycle, ACLs, Policies | ✅ Full Support |
| RDS | Instances, Subnet Groups, Parameter Groups | ✅ Full Support |
| Load Balancing | ALB, NLB, CLB, Target Groups, Listeners, SSL Policies | ✅ Full Support |
| Lambda | Functions, Layers, Permissions | ✅ Full Support |
| Route 53 | Hosted Zones, Records | ✅ Full Support |
| CloudWatch | Log Groups, Alarms, Dashboards | ✅ Full Support |
| Auto Scaling | Groups, Launch Templates, Policies | ✅ Full Support |
| ECS/ECR | Clusters, Services, Task Definitions, Repositories | ✅ Full Support |
| CloudFront | Distributions, Origin Access Controls, Cache Policies | ✅ Full Support |
| ElastiCache | Redis/Memcached Clusters, Parameter Groups | ✅ Full Support |
| ACM | Certificates | ✅ Full Support |
| EFS | File Systems, Mount Targets, Access Points | ✅ Full Support |
| API Gateway | REST APIs, Resources, Methods, Deployments | ✅ Full Support |
| SQS/SNS | Queues, Topics, Subscriptions | ✅ Full Support |
| Secrets Manager | Secrets, Versions | ✅ Full Support |
| Systems Manager | Parameters, Documents | ✅ Full Support |
| Service | Resources | Status |
|---|---|---|
| Compute | Virtual Machines, Managed Disks, Availability Sets, SSH Keys | ✅ Full Support |
| Networking | Virtual Networks, Subnets, Network Security Groups, Network Interfaces | ✅ Full Support |
| Storage | Storage Accounts, Blob Storage, File Shares | ✅ Full Support |
| Load Balancing | Load Balancers, Application Gateways | ✅ Full Support |
| Database | SQL Database, Cosmos DB | ✅ Full Support |
| Container | AKS, Container Instances | ✅ Full Support |
| Identity | Managed Identities, Service Principals | ✅ Full Support |
| Service | Resources | Status |
|---|---|---|
| Compute Engine | Instances, Disks, Images | ✅ Full Support |
| VPC | Networks, Subnets, Firewalls | ✅ Full Support |
| Cloud Storage | Buckets, Objects | ✅ Full Support |
| GKE | Clusters, Node Pools | ✅ Full Support |
# AWS: Scan EC2 with all dependencies
terraback ec2 scan --with-deps --output-dir ./infrastructure
# Azure: Scan VM with all dependencies
terraback vm scan --with-deps --output-dir ./infrastructure
# Result: Complete infrastructure graph
# ├── compute/
# │ ├── instances.tf
# │ └── launch_templates.tf
# ├── networking/
# │ ├── vpc.tf
# │ ├── subnets.tf
# │ └── security_groups.tf
# └── storage/
# ├── volumes.tf
# └── snapshots.tf
Transform generated Terraform into production-ready enterprise modules with standardized structure:
# Generate enterprise modules (requires Enterprise license)
terraback scan all aws --enterprise-modules
# Result: Organized module structure
# modules/
# ├── alb/
# │ ├── lb.tf
# │ ├── listeners.tf
# │ ├── global-accelerator.tf
# │ ├── variables.tf
# │ ├── outputs.tf
# │ └── locals.tf
# ├── ecs/
# │ └── service/
# │ ├── ecs-service.tf
# │ ├── ecs-task-definition.tf
# │ ├── autoscaling.tf
# │ ├── variables.tf
# │ ├── outputs.tf
# │ └── locals.tf
# ├── rds-aurora-postgresql/
# │ ├── cluster.tf
# │ ├── instances.tf
# │ ├── parameter-groups.tf
# │ ├── variables.tf
# │ ├── outputs.tf
# │ └── locals.tf
# └── s3-bucket/
# ├── bucket.tf
# ├── policy.tf
# ├── versioning.tf
# ├── lifecycle-configuration.tf
# ├── variables.tf
# ├── outputs.tf
# └── locals.tf
# Works with all providers
terraback scan all azure --enterprise-modules
terraback scan all gcp --enterprise-modules
Features:
Supported Module Types:
# Enable caching for large infrastructures
terraback scan-all aws --cache-ttl 45
terraback scan-recursive ec2 --use-cache --cache-ttl 60
# View cache statistics
terraback cache stats
# Clear cache
terraback cache clear
# ``--cache-ttl`` sets how long scan results stay in the on-disk cache
# (in minutes) before expiring. This can dramatically speed up repeated
# ``scan-all`` operations on very large environments.
# For even faster cache hashing install ``xxhash`` (optional). Without it
# Terraback gracefully falls back to ``blake2s``.
# Parallel scanning
terraback scan-recursive vm --parallel-workers 10
# List resources Terraback previously scanned for a provider
terraback aws list-resources -o ./generated
# Import every scanned resource for a provider into Terraform state.
# Method auto-detects the best strategy based on your Terraform version.
terraback aws import -o ./generated --method auto --yes
# Fastest for Terraform 1.5+: import all resources via import blocks in one operation
terraback aws import -o ./generated --method bulk --yes
# Most reliable: import one resource at a time (avoids state-lock conflicts)
terraback aws import -o ./generated --method sequential --yes
# Validate with `terraform plan` before importing; abort on drift unless --allow-drift
terraback aws import -o ./generated --method bulk --plan-check
# Azure and GCP use the same import command
terraback azure import -o ./generated --method auto --yes
terraback gcp import -o ./generated --method auto --yes
# Import a single resource directly
terraback aws ec2 import i-1234567890abcdef0
After scanning or when editing .tf files manually, run one of the following commands before running terraform init:
terraback aws scan-all --check
# or
python -m terraback.utils.template_syntax_fixer <output_dir>
Before executing these validation commands, ensure the base Python dependencies
are installed. The template checker relies on packages from requirements.txt,
including Jinja2. Install them with:
pip install -r requirements.txt
This prevents "Missing newline after argument" errors.
Example command sequence:
terraback scan-all aws --skip-check --output-dir ./generated
terraback aws scan-all --check
cd generated
terraform init
The --method option controls how state is imported:
auto (default) – automatically selects the best method based on your Terraform version.bulk – for Terraform 1.5+, Terraback generates import blocks that Terraform applies in a single operation. This is the fastest method (roughly 2-3 minutes for hundreds of resources).sequential – imports each resource one at a time. Slower (roughly 4 seconds per resource) but avoids state-lock conflicts and works on any Terraform version.If --method is not specified, Terraback automatically chooses bulk on Terraform 1.5+ and falls back to sequential on older versions.
Use --plan-check to run a full terraform plan validation before importing. If
the plan reports adds, changes, or destroys, the import aborts unless you also pass
--allow-drift.
Terraback uses a multi-tier licensing model:
variables.tf file with a secret_value variable stub..tfvars file before applying.Terraback respects two environment variables for logging:
TERRABACK_LOG_LEVEL controls the log verbosity (e.g. DEBUG or INFO).TERRABACK_LOG_FILE can specify a path to write logs to a file.Set these variables before running any command to adjust log output.
# Check AWS credentials
aws sts get-caller-identity
# Use specific profile
export AWS_PROFILE=production
# Debug mode
terraback ec2 scan --debug
# Check Azure login
az account show
# Set subscription
az account set --subscription "My Subscription"
# List available subscriptions
az account list --output table
--use-cache flag for large infrastructurespip install -e . for developmentTerraback generates Terraform files from a collection of Jinja2 templates. All
provider templates inherit from templates/common/base_resource.tf.j2, giving
them a shared set of helper macros and a common block to override. To create a
new template, extend the base file and implement the resources block:
{% extends "common/base_resource.tf.j2" %}
{% from "common/base_resource.tf.j2" import render_common_tags %}
{% block resources %}
resource "aws_my_service" "{{ item.name | tf_resource_name }}" {
name = "{{ item.name }}"
{{ render_common_tags(item, indent=2) }}
}
{% endblock %}
templates/common/macros.j2 exposes utilities for rendering lists and nested
structures. Examples include:
render_block_list – iterate over complex objects and emit nested blocksrender_json_list – output JSON formatted listsrender_depends_on – add a depends_on array when dependencies existThese macros keep templates concise while handling deeply nested data.
During scanning Terraback records relationships between resources. When a
template uses render_depends_on, the discovered dependencies are inserted
automatically. For example:
resource "aws_launch_template" "example" {
...
{{ macros.render_depends_on(template.depends_on, indent=2) }}
}
If an IAM role and security group were detected as dependencies, the rendered Terraform code becomes:
depends_on = [
aws_iam_role.example_role,
aws_security_group.example_sg,
]
Terraback calculates these relationships automatically, but you can still supply
additional items in the depends_on list to enforce custom ordering.
Install the additional packages used by the test suite:
pip install -r requirements-dev.txt
Then run all tests from the project root:
pytest
This project enforces LF line endings for all text files. Git uses .gitattributes to normalize line endings and a pre-commit hook (end-of-file-fixer) ensures files end with a single newline.
Built with ❤️ by DevOps engineers who understand the pain of manual cloud documentation.
Copyright © 2025 Terraback
mcp-name: io.github.bmoldo/terraback
FAQs
Terraback: Universal infrastructure scanning and Terraform generation tool
The pypi package terraback receives a total of 33 weekly downloads. As such, terraback popularity was classified as not popular.
We found that terraback demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.
Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
Research
/Security News
Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.