Infrastructure as Code (IaC) is a critical practice for managing cloud infrastructure efficiently. But what happens if you already have a large set of Azure resources and want to manage them using Terraform? You can manually reverse-engineering those existing resources into Terraform configuration files, but this involves recreating each resource by hand, and can be error-prone and time-consuming. Luckily, there are tools that can streamline this process.

In this blog, we’ll walk you through the process of reverse-engineering Azure resources into Terraform. We’ll also discuss tools like Azure Export for Terraform and touch on Terraformer, a multi-cloud solution with some caveats. By the end, you’ll have the skills to jumpstart your IaC journey with Terraform.

Getting Started: Installing the Right Tools

Before diving into reverse-engineering your Azure resources, you’ll need to install two essential tools: the Terraform CLI and Azure Export for Terraform.

Installing Terraform CLI

Terraform is the foundation for managing infrastructure as code. Here’s how to install it:

Windows

Download the Terraform CLI for Windows, extract it where you intend to keep it, and register the path in the PATH variable.

If you use chocolatey, you can simply run:

choco install terraform

macOS

Install Terraform using Homebrew

NOTE: ‘brew install terraform’ command is deprecated. It will install the old version. Run the following commands instead.

brew install hashicorp/tap/terraform
brew tap hashicorp/tap

Verify Your Installation

terraform --version

Installing Azure Export for Terraform

The next step is to install Azure Export for Terraform which is a tool that simplifies the process of generating Terraform configuration files from existing Azure resources.

Windows

winget install aztfexport

macOS

brew install aztfexport

Step-by-Step: Reverse-Engineering a Resource Group

Now that you have the tools installed, let’s reverse-engineer a resource group and all of it’s resourced from Azure into a Terraform configuration file.

Step 1: Authenticate with Azure

Log in to Azure using the Azure CLI:

az login

Verify the subscription you want to use:

az account show

Step 2: Export Resources

This is where the fun begins. Assuming you’ve logged in to az cli as instructed in the previous step, you can simply run the following command:

aztfexport resource-group dev-thterraformerazure-rg

I’ve used dev-thterraformerazure-rg, but you’d replace it with your resource group name. I suggest you run this command in an empty directory. When the program starts, it checks if there any files in the current directory and if so, guides you to choose the right option.

The next step is initializing, which might take a minute or two depending on how many resources are in your azure resource group. It looks something like this:

Next stage is interactive, and you will see a list of resources with option to either skip or include each one.

You will find the legend at the bottom explaining the keyboard keys you can use to navigate the interface.

Pressing ‘w’ will initiate the import process for the selected resource.

Step 3: Validate the Terraform Configuration

Once finished, you should see a main.tf file with your resources imported in it. This is where some Terraform experience will come useful. You can go ahead and run terraform init followed by terraform plan. As for the second of those, you will immediately see that not everything is configured correctly. A few things will need to be changed. For example, in my import, I had to change the following:

• Adding username and password on the azurerm_mssql_server instance
• Removing azurerm_container_registry_scope_map resources and replacing them with group assignments (NOTE: scope maps are a preview feature and apply only to premium instances)
• Some identifiers including key_vault_id are added as strings, rather than key vault references (after all key vault resource is created within the same file)
• Remove depends_on from most of the resources and replacing them with direct resource references

Other than those minor changes, the tool does a pretty go job of getting you jumpstarted with your Terraform file for existing resources. Even as an experienced Terraform, it’s much better to start with some generated output like this rather than just an empty file.

Let’s now compare Azure Export for Terraform with the other tool worth mentioning.

Terraformer: A Multi-Cloud Option

Another tool for reverse-engineering cloud resources is Terraformer, an open-source project designed to support multiple cloud platforms like Azure, AWS, and Google Cloud. Terraformer’s promise is enticing, but it comes with some drawbacks:

• Outdated Terraform CLI Support: Terraformer has lagged behind updates to the Terraform and azurerm provider, which can cause compatibility issues (e.g., it generates azurerm_sql_server resources which were discontinued long time ago in favor of azurerm_mssql_server)
• Limited Azure Resource Support: While it works well with Google Cloud (its original target) and AWS, Azure support is incomplete, making it less reliable for complex Azure environments.

If you’re managing a multi-cloud environment, Terraformer might be worth exploring, especially for non-Azure resources. However, for Azure-specific IaC, tools like Azure Export for Terraform are more dependable.

Conclusion

Reverse-engineering existing Azure resources into Terraform can save you significant time when starting your IaC journey.

Looking to level up your DevOps and IaC skills? Trailhead specializes in cloud, DevOps, and Terraform solutions to help you streamline your infrastructure management. Reach out to learn how Trailhead can empower your team to succeed.