Reverse-Engineering Live Cloud Infrastructure into Terraform IaC with Terraformer

Many growing startups build their initial AWS or Google Cloud infrastructure manually in the web console ("ClickOps"). When it is time to pass SOC 2 / HIPAA audits, replicate staging environments, or prevent configuration drift, a Senior Cloud Architect needs to bring those live resources under Terraform Infrastructure-as-Code (IaC) without causing downtime.

1. Exporting Existing Cloud Resources with Terraformer

Google's open-source CLI tool Terraformer inspects live cloud provider APIs (GCP, AWS, Azure, Cloudflare) and automatically generates both .tf HCL configuration files and the matching terraform.tfstate state file:

# Import GCP Cloud Run, Compute Engine, and Firewall rules into HCL:
terraformer import google --resources=run,instances,firewall --projects=my-production-project --regions=us-east1

# Import AWS ALB, Auto Scaling Groups, and Security Groups:
terraformer import aws --resources=alb,auto_scaling,sg --regions=us-east-1

2. Refactoring Generated HCL into Clean Modules

1. Upgrade State Version: Run terraform state replace-provider and verify with terraform plan that zero destructive changes are pending.
2. Replace Hardcoded IDs with References: Convert hardcoded subnet and security group strings into symbolic resource attributes (e.g., aws_subnet.public_a.id).
3. Enforce CI/CD Plan Gates: Store state remotely in GCS or S3 with state locking so every future infrastructure change is peer-reviewed via Git pull requests.