Aztfexport

aztfexport — Export Azure Resources to Terraform

Overview

aztfexport is a Microsoft tool that exports existing Azure resources into Terraform HCL + state. It reverse-engineers live Azure infrastructure into Terraform configurations. Use this for Azure-only workflows or Terraform versions before 1.14's native terraform query.

When to Use

• Export a single Azure resource to Terraform → aztfexport resource
• Export an entire resource group → aztfexport resource-group
• Export resources matching an Azure Resource Graph query → aztfexport query
• Bootstrapping IaC from existing Azure infrastructure

Use `terraform-search-import` skill instead when: Terraform >= 1.14 with terraform query + bulk import (multi-cloud, not Azure-specific).

Prerequisites

1. aztfexport installed: brew install aztfexport (macOS) or see GitHub releases 2. Azure CLI authenticated: az login + correct subscription selected 3. Architecture check (critical on macOS):

   file $(which aztfexport)  # Check binary arch
   uname -m                  # Check system arch

If mismatch (e.g., x86_64 binary on arm64 Mac), reinstall the correct architecture version.

Workflow

Step 1: Discover the Resource ID

Use Azure CLI to find the resource ID. See references/RESOURCE-DISCOVERY.md for patterns by resource type.

Generic fallback:

az resource list --query "[?name=='RESOURCE_NAME']" -o table

Step 2: Validate aztfexport Binary

file $(which aztfexport)
uname -m
aztfexport --version

Architecture mismatch causes cryptic failures. Always verify before first use on a new machine.

Step 3: Run aztfexport

Single resource:

aztfexport resource \
  --non-interactive \
  --plain-ui \
  -o ./terraform-export \
  "/subscriptions/SUB_ID/resourceGroups/RG/providers/TYPE/NAME"

Resource group:

aztfexport resource-group \
  --non-interactive \
  --plain-ui \
  -o ./terraform-export \
  RESOURCE_GROUP_NAME

Azure Resource Graph query:

aztfexport query \
  --non-interactive \
  --plain-ui \
  -o ./terraform-export \
  "resources | where name == 'MY_RESOURCE'"

Step 4: Review Generated Files

ls ./terraform-export/
# Expect: main.tf, provider.tf, terraform.tfstate, import.tf (sometimes)

• main.tf — generated HCL with res-0 style resource names
• provider.tf — AzureRM provider configuration
• terraform.tfstate — imported state file
• Consider renaming res-0 to descriptive names (update both HCL and state)

Step 5: Verify

cd ./terraform-export
terraform init
terraform plan

A clean plan (no changes) confirms successful export. Minor diffs may appear for computed attributes — review and suppress with lifecycle { ignore_changes } if appropriate.

Critical Flags

Gotchas & Troubleshooting

Example: Export an Activity Log Alert

# Step 1: Find the resource ID
az monitor activity-log alert list -g myResourceGroup \
  --query "[?name=='my-alert'].id" -o tsv

# Step 2: Export
aztfexport resource \
  --non-interactive \
  --plain-ui \
  -o ./alert-export \
  "/subscriptions/xxxx/resourceGroups/myRG/providers/Microsoft.Insights/activityLogAlerts/my-alert"

# Step 3: Verify
cd ./alert-export
terraform init
terraform plan

---

Gotchas

• Architecture mismatch between the aztfexport binary and the AzureRM provider's CGO bindings — Apple Silicon needs ARM64 build, x86 binary on M-series silently degrades.
• Resource-name regex defaults exclude special chars — resources with . in the name (FQDNs, etc.) are skipped silently.
• Generated `import` blocks (Terraform 1.5+) vs `state import` commands — aztfexport now writes blocks; older workflows expecting state-import calls break.
• `--include-role-assignment` is OFF by default — RBAC is left out of state, which is usually exactly what you don't want.
• Provider version pinning: aztfexport pins to specific AzureRM versions in its imports; mismatched provider in your target stack causes spurious plan diffs.
• Non-interactive (`-n`) skips name customization — auto-generated TF names like azurerm_storage_account_001 end up in your code permanently if not reviewed.

Azure Resource Discovery — CLI Patterns

Azure CLI commands for finding resource IDs by type. All commands output the resource ID needed for aztfexport resource.

Generic Fallback

Works for any resource type when you know the name:

# By name
az resource list --query "[?name=='RESOURCE_NAME']" -o table

# By name with resource ID only
az resource list --query "[?name=='RESOURCE_NAME'].id" -o tsv

# By type
az resource list --resource-type "Microsoft.Compute/virtualMachines" -o table

# By resource group
az resource list -g RESOURCE_GROUP_NAME -o table

Monitor Alerts

Azure alerts span 3 different API endpoints — check each if unsure of the alert type:

# Metric alerts
az monitor metrics alert list -g RG_NAME --query "[?name=='ALERT_NAME'].id" -o tsv

# Scheduled query rules (log alerts)
az monitor scheduled-query list -g RG_NAME --query "[?name=='ALERT_NAME'].id" -o tsv

# Activity log alerts
az monitor activity-log alert list -g RG_NAME --query "[?name=='ALERT_NAME'].id" -o tsv

Tip: If you don't know which type, run all three in parallel.

Compute

# Virtual Machines
az vm list -g RG_NAME --query "[].{name:name, id:id}" -o table

# VM Scale Sets
az vmss list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Disks
az disk list -g RG_NAME --query "[].{name:name, id:id}" -o table

Networking

# Virtual Networks
az network vnet list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Subnets (need vnet name)
az network vnet subnet list -g RG_NAME --vnet-name VNET_NAME --query "[].{name:name, id:id}" -o table

# Network Security Groups
az network nsg list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Public IPs
az network public-ip list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Load Balancers
az network lb list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Application Gateways
az network application-gateway list -g RG_NAME --query "[].{name:name, id:id}" -o table

# NAT Gateways
az network nat gateway list -g RG_NAME --query "[].{name:name, id:id}" -o table

Storage

# Storage Accounts
az storage account list -g RG_NAME --query "[].{name:name, id:id}" -o table

Key Vault

az keyvault list -g RG_NAME --query "[].{name:name, id:id}" -o table

Kubernetes (AKS)

az aks list -g RG_NAME --query "[].{name:name, id:id}" -o table

Databases

# Azure SQL Server
az sql server list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Azure SQL Database (need server name)
az sql db list -g RG_NAME -s SERVER_NAME --query "[].{name:name, id:id}" -o table

# CosmosDB
az cosmosdb list -g RG_NAME --query "[].{name:name, id:id}" -o table

# PostgreSQL Flexible Server
az postgres flexible-server list -g RG_NAME --query "[].{name:name, id:id}" -o table

App Services

# Web Apps / App Services
az webapp list -g RG_NAME --query "[].{name:name, id:id}" -o table

# Function Apps
az functionapp list -g RG_NAME --query "[].{name:name, id:id}" -o table

# App Service Plans
az appservice plan list -g RG_NAME --query "[].{name:name, id:id}" -o table

Container Registry

az acr list -g RG_NAME --query "[].{name:name, id:id}" -o table

Azure Resource Graph (Cross-Subscription)

For finding resources across multiple subscriptions:

# By name across all subscriptions
az graph query -q "resources | where name == 'RESOURCE_NAME' | project id, name, type, resourceGroup"

# By type across all subscriptions
az graph query -q "resources | where type == 'microsoft.compute/virtualmachines' | project id, name, resourceGroup"

Requires az extension add --name resource-graph if not installed.