Export AWS Infrastructure into Terraform (Single File)

[nidhin077]

Hi,

I’m trying to export my current AWS infrastructure (covering services like EC2, ALB, S3, Lambda, RDS, etc.) into Terraform so that I can manage everything going forward using IaC.
But using the terraformer I exported all my code to singe file byuisng the below command

terraformer import aws \
  --resources="*" \
  --regions=us-west-2 \
  --compact \
  --path-pattern="{output}/{provider}/" \
  --path-output=aws

This command completed successfully, and the configuration was exported into a single file.

However, when running terraform init inside the generated folder, I received an error.

terraform init

Initializing the backend...
╷
│ Warning: Quoted references are deprecated
│
│ on resources.tf line 813, in resource "aws_iam_access_key" "tfer--AKIARWVAD3K43EUGGAVG":
│ 813: depends_on = ["aws_iam_user.tfer--AIDARWVAD3K4XJRSJFKWX"]
│
│ In this context, references are expected literally rather than in quotes. Terraform 0.11 and earlier required quotes, but quoted references are now deprecated and will be removed in a future version of
│ Terraform. Remove the quotes surrounding this reference to silence this warning.
│
│ (and 19 more similar warnings elsewhere)
╵
╷
│ Error: Invalid legacy provider address
│
│ This configuration or its associated state refers to the unqualified provider "aws".
│
│ You must complete the Terraform 0.13 upgrade process before upgrading to later versions.

To resolve it, I ran the following command:

terraform state replace-provider registry.terraform.io/-/aws registry.terraform.io/hashicorp/aws

After that, terraform init worked.

The next step was running terraform plan to compare the exported code with the actual AWS environment, but I encountered numerous errors and mismatches.

Error: Missing required argument
│
│ with aws_vpc.tfer--vpc-1ba73b7e,
│ on resources.tf line 7707, in resource "aws_vpc" "tfer--vpc-1ba73b7e":
│ 7707: ipv6_netmask_length = "0"
│
│ "ipv6_netmask_length": all of ipv6_ipam_pool_id,ipv6_netmask_length must be specified
╵
╷
│ Error: Missing required argument
│
│ with aws_vpc.tfer--vpc-41d60f39,
│ on resources.tf line 7718, in resource "aws_vpc" "tfer--vpc-41d60f39":
│ 7718: ipv6_netmask_length = "0"
│
│ "ipv6_netmask_length": all of ipv6_ipam_pool_id,ipv6_netmask_length must be specified
╵
╷
│ Error: Missing required argument
│
│ with aws_vpc.tfer--vpc-e4a73b81,
│ on resources.tf line 7729, in resource "aws_vpc" "tfer--vpc-e4a73b81":
│ 7729: ipv6_netmask_length = "0"
│
│ "ipv6_netmask_length": all of ipv6_ipam_pool_id,ipv6_netmask_length must be specified
╵
╷
│ Error: Missing required argument
│
│ with aws_vpc.tfer--vpc-e5a73b80,
│ on resources.tf line 7740, in resource "aws_vpc" "tfer--vpc-e5a73b80":
│ 7740: ipv6_netmask_length = "0"
│
│ "ipv6_netmask_length": all of ipv6_ipam_pool_id,ipv6_netmask_length must be specified
╵
╷
│ Error: Missing required argument
│
│ with aws_vpc.tfer--vpc-e7a73b82,
│ on resources.tf line 7751, in resource "aws_vpc" "tfer--vpc-e7a73b82":
│ 7751: ipv6_netmask_length = "0"
│
│ "ipv6_netmask_length": all of ipv6_ipam_pool_id,ipv6_netmask_length must be specified

Requirement:

I need to properly export the AWS infrastructure code into a single file (to avoid complexity and connection issues).
Looking for a recommended or proper method to achieve this so that the exported Terraform code aligns correctly with the existing AWS environment.

Expected Outcome:

A clean export of AWS resources into a single Terraform file.
Ability to run Terraform plan without major mismatches against the existing infrastructure.

[Minxhvk]

I had the same issue.

The first problem is related to the Terraform version. Terraformer still generates code in Terraform 0.11 style, which is why you see lines like depends_on = ["..."]. In modern Terraform, it should be depends_on = [ ... ]. Updating the provider address with terraform state replace-provider (as you already did) is the correct approach.

The second problem is due to the ipv6_netmask_length argument in VPC resources. Terraformer incorrectly sets ipv6_netmask_length = "0". In the current AWS provider, ipv6_ipam_pool_id and ipv6_netmask_length must always be specified together. If you’re not using an IPAM pool for IPv6 CIDR allocation, you should simply remove the ipv6_netmask_length line. If you are using IPAM, then you need to specify both ipv6_ipam_pool_id and a valid ipv6_netmask_length.

In most cases, removing those autogenerated ipv6_netmask_length lines resolves the issue.