Terraform Import Guides
How to import existing AWS, Azure, and Google Cloud resources into Terraform - with the exact import block and generated HCL for each resource type.
Terraback turns live infrastructure into Terraform: scan an account, and it writes both the resource blocks and the Terraform 1.5+ import blocks. Pick a resource below for a step-by-step guide, or import your whole account at once with
terraback scan all followed by terraback <provider> import --method bulk.AWS
130 guides
- AWS EC2 Instance
- AWS S3 Bucket
- AWS VPC
- AWS Security Group
- AWS Subnet
- AWS IAM Role
- AWS IAM Policy
- AWS RDS Database Instance
- AWS Lambda Function
- AWS DynamoDB Table
- AWS SNS Topic
- AWS SQS Queue
- AWS ECS Cluster
- AWS ECR Repository
- AWS Route 53 Hosted Zone
- AWS CloudFront Distribution
- AWS ACM Certificate
- AWS AMI
- AWS API Gateway REST API
- AWS Auto Scaling Group
- AWS Backup Vault
- AWS CloudTrail
- AWS CloudWatch Dashboard
- AWS EventBridge Rule
- AWS CloudWatch Log Group
- AWS CloudWatch Metric Alarm
- AWS RDS DB Subnet Group
- AWS EBS Snapshot
- AWS EBS Volume
- AWS Transit Gateway
- AWS ECS Service
- AWS ECS Task Definition
- AWS EFS File System
- AWS Elastic IP
- AWS EKS Cluster
- AWS EKS Node Group
- AWS ElastiCache Cluster
- AWS ElastiCache Replication Group
- AWS Classic Load Balancer
- AWS VPC Flow Log
- AWS GuardDuty Detector
- AWS Internet Gateway
- AWS EC2 Key Pair
- AWS Kinesis Data Firehose Delivery Stream
- AWS Kinesis Data Stream
- AWS KMS Key
- AWS Lambda Layer Version
- AWS EC2 Launch Template
- AWS Application/Network Load Balancer
- AWS Load Balancer Listener
- AWS Load Balancer Target Group
- AWS NAT Gateway
- AWS Elastic Network Interface
- AWS Route 53 Record
- AWS Route Table
- AWS S3 Bucket Policy
- AWS Secrets Manager Secret
- AWS Step Functions State Machine
- AWS SSM Document
- AWS SSM Parameter
- AWS VPC Endpoint
- AWS WAFv2 Web ACL
- AWS API Gateway Stage
- AWS API Gateway Resource
- AWS API Gateway Method
- AWS Auto Scaling Policy
- AWS CloudFront Origin Access Control
- AWS CloudWatch Composite Alarm
- AWS EventBridge Target
- AWS RDS DB Parameter Group
- AWS Transit Gateway VPC Attachment
- AWS ECR Lifecycle Policy
- AWS ECR Repository Policy
- AWS EFS Access Point
- AWS EFS Mount Target
- AWS EKS Add-on
- AWS ElastiCache Parameter Group
- AWS ElastiCache Subnet Group
- AWS KMS Alias
- AWS Lambda Permission
- AWS Load Balancer Listener Rule
- AWS Target Group Attachment
- AWS Route
- AWS Route Table Association
- AWS S3 Bucket Versioning
- AWS S3 Bucket Encryption
- AWS S3 Bucket Lifecycle Configuration
- AWS S3 Bucket Public Access Block
- AWS S3 Bucket ACL
- AWS S3 Bucket Website Configuration
- AWS S3 Bucket Notification
- AWS Secrets Manager Secret Version
- AWS Security Group Rule
- AWS SNS Topic Subscription
- AWS SSM Maintenance Window
- AWS API Gateway Deployment
- AWS API Gateway Integration
- AWS API Gateway Integration Response
- AWS API Gateway Method Response
- AWS CloudFront Cache Policy
- AWS CloudFront Origin Request Policy
- AWS Transit Gateway Connect
- AWS Transit Gateway Connect Peer
- AWS Transit Gateway Multicast Domain
- AWS Transit Gateway Peering Attachment
- AWS Transit Gateway Peering Attachment Accepter
- AWS Transit Gateway Route
- AWS Transit Gateway Route Table
- AWS Transit Gateway Route Table Association
- AWS Transit Gateway Route Table Propagation
- AWS EFS Backup Policy
- AWS EFS File System Policy
- AWS EKS Identity Provider Config
- AWS Launch Configuration
- AWS LB Listener Certificate
- AWS LB SSL Negotiation Policy
- AWS Network Interface Attachment
- AWS S3 Bucket CORS Configuration
- AWS S3 Bucket Logging
- AWS S3 Bucket Ownership Controls
- AWS Secrets Manager Secret Policy
- AWS Step Functions Activity
- AWS Step Functions Alias
- AWS SSM Maintenance Window Target
- AWS SSM Maintenance Window Task
- AWS WAFv2 Web ACL Association
- AWS WAFv2 Web ACL Logging Configuration
- AWS X-Ray Encryption Config
- AWS X-Ray Group
- AWS X-Ray Sampling Rule
Azure
101 guides
- Azure Virtual Machine
- Azure Storage Account
- Azure Virtual Network
- Azure Resource Group
- Azure Key Vault
- Azure Kubernetes Service (AKS) Cluster
- Azure Subnet
- Azure API Management
- Azure App Configuration
- Azure Application Gateway
- Azure Application Insights
- Azure Automation Account
- Azure CDN Endpoint
- Azure CDN Profile
- Azure Container Registry
- Azure Cosmos DB Account
- Azure Cosmos DB SQL Database
- Azure Data Factory
- Azure Databricks Workspace
- Azure DNS Zone
- Azure DNS A Record
- Azure Event Hub
- Azure Event Hubs Namespace
- Azure Event Grid Topic
- Azure Key Vault Secret
- Azure Key Vault Key
- Azure Kubernetes Node Pool
- Azure Load Balancer
- Azure Log Analytics Workspace
- Azure Logic App Workflow
- Azure Managed Disk
- Azure Monitor Action Group
- Azure Monitor Metric Alert
- Azure SQL Database
- Azure SQL Server
- Azure NAT Gateway
- Azure Network Interface
- Azure Network Security Group
- Azure Private DNS Zone
- Azure Private Endpoint
- Azure Public IP
- Azure Recovery Services Vault
- Azure Cache for Redis
- Azure Role Assignment
- Azure Route Table
- Azure AI Search Service
- Azure Service Bus Namespace
- Azure Service Bus Queue
- Azure Service Bus Topic
- Azure App Service Plan
- Azure Storage File Share
- Azure User-Assigned Managed Identity
- Azure Virtual Network Peering
- Azure Web Application Firewall Policy
- Azure API Management API
- Azure Application Security Group
- Azure Automation Runbook
- Azure Cosmos DB SQL Container
- Azure DNS CNAME Record
- Azure Event Grid Event Subscription
- Azure Event Hub Consumer Group
- Azure Managed Image
- Azure Key Vault Certificate
- Azure Load Balancer Backend Pool
- Azure Load Balancer Rule
- Azure Load Balancer Probe
- Azure Load Balancer NAT Rule
- Azure Linux VM Scale Set
- Azure Windows VM Scale Set
- Azure Monitor Autoscale Setting
- Azure Monitor Diagnostic Setting
- Azure SQL Firewall Rule
- Azure SQL Elastic Pool
- Azure Private DNS A Record
- Azure Custom Role Definition
- Azure Route
- Azure Service Bus Subscription
- Azure Subnet NSG Association
- Azure VM Data Disk Attachment
- Azure azapi_resource
- Azure API Connection
- Azure Container Registry Webhook
- Azure DNS NS Record
- Azure Monitor Activity Log Alert
- Azure Monitor Scheduled Query Rule Alert (v2)
- Azure SQL Database Extended Auditing Policy
- Azure SQL Server Extended Auditing Policy
- Azure SQL Server Security Alert Policy
- Azure SQL Virtual Network Rule
- Azure NetApp Account
- Azure NetApp Capacity Pool
- Azure NetApp Volume
- Azure Portal Dashboard
- Azure Proximity Placement Group
- Azure Cache for Redis Enterprise Cluster
- Azure Cache for Redis Enterprise Database
- Azure Redis Firewall Rule
- Azure Redis Linked Server
- Azure SSH Public Key
- Azure Subnet NAT Gateway Association
- Azure Subnet Route Table Association
Google Cloud
91 guides
- Google Compute Engine Instance
- Google Cloud Storage Bucket
- Google VPC Network
- Google Kubernetes Engine (GKE) Cluster
- Google Cloud SQL Instance
- Google VPC Subnetwork
- Google Pub/Sub Topic
- Google Artifact Registry Repository
- Google BigQuery Dataset
- Google BigQuery Table
- Google Cloud Bigtable Instance
- Google Cloud Build Trigger
- Google Cloud Functions (2nd gen)
- Google Cloud Run Service
- Google Cloud Run Job (v2)
- Google Cloud Scheduler Job
- Google Cloud Tasks Queue
- Google Cloud Composer Environment
- Google Compute Regional Address
- Google Compute Backend Service
- Google Compute Persistent Disk
- Google Compute Firewall Rule
- Google Compute Regional Forwarding Rule
- Google Compute Global Forwarding Rule
- Google Compute Health Check
- Google Compute Image
- Google Compute Unmanaged Instance Group
- Google Compute Instance Template
- Google Compute Cloud Router
- Google Compute Cloud NAT
- Google Cloud Armor Security Policy
- Google Compute Disk Snapshot
- Google Compute Target HTTPS Proxy
- Google Compute URL Map
- Google Compute VPN Tunnel
- Google Kubernetes Engine Node Pool
- Google Cloud Dataproc Cluster
- Google Cloud DNS Managed Zone
- Google Cloud DNS Record Set
- Google Cloud Filestore Instance
- Google Cloud Firestore Database
- Google Cloud KMS Crypto Key
- Google Cloud KMS Key Ring
- Google Cloud Logging Project Sink
- Google Memorystore for Memcached
- Google Cloud Monitoring Alert Policy
- Google Cloud Monitoring Notification Channel
- Google Memorystore for Redis
- Google Secret Manager Secret
- Google IAM Service Account
- Google Cloud Spanner Instance
- Google Cloud Spanner Database
- Google Cloud SQL Database
- Google Cloud Workflows Workflow
- Google API Gateway Gateway
- Google API Gateway API
- Google Cloud Bigtable Table
- Google Binary Authorization Policy
- Google Certificate Manager Certificate
- Google Compute Backend Bucket
- Google VPC Network Peering
- Google Compute Regional Backend Service
- Google Compute Target HTTP Proxy
- Google Compute Target SSL Proxy
- Google Container Registry
- Google Eventarc Trigger
- Google Firestore Index
- Google Cloud Monitoring Dashboard
- Google Private CA Certificate Authority
- Google Project IAM Custom Role
- Google Pub/Sub Subscription
- Google Secret Manager Secret Version
- Google Service Account Key
- Google API Gateway API Config
- Google Cloud Bigtable App Profile
- Google Bigtable Table IAM Binding
- Google Certificate Manager Certificate Map
- Google Cloud Run Service IAM Policy
- Google Regional Target HTTP Proxy
- Google Regional Target HTTPS Proxy
- Google Regional Target TCP Proxy
- Google Regional URL Map
- Google Target TCP Proxy
- Google Deployment Manager Deployment
- Google KMS Crypto Key IAM Member
- Google KMS Key Ring IAM Member
- Google Project IAM Binding
- Google Project IAM Member
- Google Spanner Database IAM Binding
- Google Spanner Instance IAM Binding
- Google Cloud Storage Bucket IAM Binding
Import your whole cloud in one pass
These 322 guides cover the resource types Terraback scans across AWS, Azure, and GCP. Instead of importing one at a time, scan your account and generate Terraform plus import blocks for everything in a single pass.