Terraback is a command-line tool that reverse-engineers your existing cloud infrastructure into clean, maintainable Terraform configurations. It discovers resources across AWS, Azure, and Google Cloud, maps their dependencies, and generates production-ready .tf files in seconds — so you can adopt Infrastructure-as-Code on infrastructure that was originally built by hand.

terraform import only attaches an existing resource to a Terraform state file — it does not generate the corresponding HCL configuration. You still have to write every block by hand and reconcile dozens of arguments. Terraback does both:

• Automatically discovers every supported resource in your account
• Generates complete .tf files with all arguments and references
• Resolves dependencies between resources (subnets ↔ security groups ↔ instances)
• Emits import blocks (Terraform 1.5+) or import scripts so the resulting state matches reality
• Saves up to 90% of the time compared to manual import

Terraback currently supports:

• AWS: 80+ resource types including EC2, VPC, RDS, Lambda, S3, IAM, ECS, EKS, ELB, Route 53, CloudFront, and more
• Azure: 80+ resource types including Virtual Machines, Networks, Storage, AKS, App Service, Key Vault
• Google Cloud: 80+ resource types including Compute Engine, VPC Networks, GKE, Cloud Storage, Cloud SQL

We add new services regularly based on user demand. The full list lives in the supported services page.

Yes. Terraback is designed so your infrastructure data never leaves your machine:

• Runs locally — scanning, parsing, and code generation all happen on the host you run it from
• Read-only IAM — Terraback only needs Describe*, List*, and Get* permissions, never write/modify
• No credential storage — it reuses the credentials your AWS CLI / Azure CLI / gcloud are already using
• No telemetry of resource data — only anonymized command-level usage metrics are sent
• License validation is offline after first activation

Yes. Terraback emits standard HCL2 syntax that is fully compatible with OpenTofu, Terraform 1.x, and Terragrunt. The generated files use the same provider blocks and resource schemas, so you can swap terraform for tofu without changing anything in the output.

• Operating Systems: Windows 10+, macOS 10.15+, Linux (Ubuntu 18.04+, Debian 10+, RHEL/CentOS 7+, Amazon Linux 2)
• Memory: 4 GB RAM minimum, 8 GB recommended for accounts with 1,000+ resources
• Disk Space: ~500 MB for installation
• Cloud CLI Tools: AWS CLI v2, Azure CLI, or gcloud SDK — whichever providers you plan to scan
• Python: 3.8 or higher (only when installing via pip; standalone binaries bundle their own runtime)

Terraback reuses your existing CLI authentication — there is nothing to configure inside Terraback itself.

# AWS
aws configure
terraback scan all aws

# Azure
az login
terraback scan all azure

# Google Cloud
gcloud auth application-default login
terraback scan all gcp

Yes. Anything the underlying cloud SDK can resolve will work — including AWS SSO sessions, AWS IAM Identity Center, aws sts assume-role profiles, Azure managed identities, and GCP service-account impersonation. Pass the profile or environment variables you would normally use:

terraback scan all aws --profile production

Terraback emits:

• Terraform HCL (.tf files) — the default, idiomatic format
• Import blocks — declarative import { ... } blocks for Terraform 1.5+, generated alongside the .tf files
• Import metadata — JSON describing each resource so terraback <provider> import can bring them into state on older Terraform versions

First scan, then run the import command with the method that matches your Terraform version:

# 1. Scan to generate .tf files and import metadata
terraback scan all aws -o ./generated

# 2a. Bulk import via import blocks (Terraform 1.5+ — recommended, fastest)
terraback aws import -o ./generated --method bulk --yes

# 2b. Sequential import (works on any Terraform version)
terraback aws import -o ./generated --method sequential --yes

# Or let Terraback pick the best method automatically
terraback aws import -o ./generated --method auto --yes

Yes. Instead of scanning the whole account, scan one service at a time using its subcommand:

# Scan only S3
terraback aws s3 scan

# Scan only EC2 instances
terraback aws ec2 scan-instances --region us-east-1

Terraback emits human-readable HCL grouped by service, with cross-references resolved to Terraform expressions (aws_subnet.main.id) instead of literal IDs. Variables are extracted for things that look environment-specific (account IDs, region names, common tags), so the same module can be reused across accounts with minimal edits.

Terraback's primary use case is generating Terraform for the cloud you're already on, not translating between providers. That said, having clean, normalized HCL is the prerequisite for any migration project — once your AWS infrastructure is described in code, it's far easier to plan an equivalent Azure or GCP topology by hand.

Terraback ships an MCP (Model Context Protocol) server — run locally over stdio via terraback mcp — that gives AI agents six tools to scan live cloud infrastructure and generate Terraform HCL with import blocks deterministically. It works with any MCP client, including Claude Code, Claude Desktop, Cursor, and Windsurf.

Yes. Once you register the server with claude mcp add terraback -- terraback mcp, Claude Code can call scan_infrastructure to inventory your AWS, Azure, or GCP account, then codify_resource or codify_batch to generate the matching Terraform HCL and import blocks — no manual terraform import per resource.

Yes. Google's Terraformer was archived and made read-only on 2026-03-16, so it no longer receives updates or new resource support. Terraback is the only open, self-hosted MCP server doing deterministic multi-cloud (AWS, Azure, and GCP) codification with import blocks — actively maintained, no SaaS account required, and no LLM-guessed HCL.

No. It runs locally over stdio with read-only cloud credentials (AWS ReadOnlyAccess + SecurityAudit, Azure Reader, GCP roles/viewer) — the same credentials your CLI tools already use. Nothing about your infrastructure or credentials transits any Terraback service — there's no telemetry, and license activation is offline after first use.

The Community license is free and includes the full MCP server and all six tools. codify_batch — the batch codification tool — is capped at 25 resources per run on Community; a Professional license lifts that cap. scan_infrastructure, codify_resource, detect_unmanaged, verify_plan, and list_supported_resources are unrestricted on Community.

verify_plan runs terraform init and terraform plan on the HCL an agent just generated and returns a parsed summary of adds, changes, and destroys. If it finds drift, the agent can adjust the generated code and call verify_plan again — looping until the plan is clean, which is how Terraback's generated code is verified to apply as imports-only on all three clouds.

pip install terraback
claude mcp add terraback -- terraback mcp

Or run it with no install via uvx:

uvx terraback mcp

Requires Python 3.10+ and, if you want to use verify_plan, Terraform 1.5 or newer.

• Community (free): core scanning across AWS, Azure, and GCP, basic dependency mapping, the full MCP server (codify_batch capped at 25 resources/run), and unlimited use for personal/small projects
• Professional ($499, one-time): lifetime access to all 240+ resource types across AWS, Azure and GCP, advanced dependency mapping, parallel multi-account scanning, the MCP server with no codify_batch cap, priority email support, and all future updates

• Lifetime access to every supported service across AWS, Azure, and GCP
• Advanced dependency mapping for complex networking and IAM relationships
• Multi-account / multi-profile parallel scanning
• Priority email support at support@terraback.io
• All future updates — no annual renewal

Per-user. The license is fingerprint-bound at activation. If you replace your machine, contact support@terraback.io to reset the activation so you can re-activate on the new hardware.

Community can be used in CI for non-commercial or evaluation work. Production CI/CD use of paid features (parallel scanning, advanced dependency mapping, all services beyond the Community subset) requires a Professional license.

The most common causes, in order:

1. Insufficient IAM permissions — Terraback needs Describe* / List* / Get* on the services you're scanning
2. Wrong region — by default Terraback scans only the region your CLI is configured for; use --all-regions or --region
3. Service not yet supported — check the supported services page
4. Resource is in a different account — for cross-account, scan with the appropriate AWS_PROFILE

Run with --debug for a verbose log of what was attempted and what was skipped.

Terraback detects cycles during dependency resolution and breaks them by emitting explicit depends_on blocks rather than direct references. The generated configuration is always plan-able even when the underlying graph has cycles (security group ↔ security group rules, for example).

For large accounts:

• Scan one service at a time using its subcommand (e.g. terraback aws ec2 scan-instances)
• Limit by region: --region us-east-1 instead of --all-regions
• Enable parallel processing (Professional only): --parallel 8
• Turn on caching for repeat scans (opt-in): --cache

• Email: support@terraback.io
• Website: contact form at terraback.io

Yes, with Professional:

# Scan a specific named profile
terraback scan all aws --profile production

# Custom output directory
terraback scan all aws -o ./my-terraform

Terraback organizes the generated .tf files by service automatically.

Scan time scales roughly with resource count. These are estimates — the cloud provider's API rate limits, not Terraback, are usually the bottleneck:

• Small (under 100 resources): ~30 seconds
• Medium (hundreds of resources): 1–3 minutes
• Large (1,000+ resources): 5–20 minutes (lower with --cache on repeat runs)

Professional includes parallel scanning, which can significantly reduce wall-clock time on multi-region or multi-account workloads.

Yes — it has been used on accounts with 1,000+ EC2 instances, 5,000+ Lambda functions, and tens of thousands of IAM resources. Pagination, caching, and rate-limit-aware retries are built in, so the SDK's API limits become the bottleneck rather than Terraback itself.

• Official docs: docs.terraback.io
• Website: terraback.io
• README: ships with the binary and the pip package

• Email: support@terraback.io (priority for Professional customers)
• Website contact form: terraback.io

To get a fast answer, include:

• Terraback version (pip show terraback)
• Cloud provider, region, and account size (rough resource count)
• Error messages or --debug output
• Your license type (Community or Professional)

• Feature releases: roughly monthly
• Bug-fix and security patches: as needed, usually within days

All updates are included with a Professional license — there's no renewal.