Import-Infrastructure-As-Code

# Import Infrastructure as Code (Azure -> Terraform with AVM)

Convert existing Azure infrastructure into maintainable Terraform code using discovery data and Azure Verified Modules.

When to Use This Skill

Use this skill when the user asks to:

- Import existing Azure resources into Terraform

- Generate IaC from live Azure environments

- Handle any Azure resource type supported by AVM (and document justified non-AVM fallbacks)

- Recreate infrastructure from a subscription or resource group

- Map dependencies between discovered Azure resources

- Use AVM modules instead of handwritten `azurerm_*` resources

Prerequisites

- Azure CLI installed and authenticated (`az login`)

- Access to the target subscription or resource group

- Terraform CLI installed

- Network access to Terraform Registry and AVM index sources

Inputs

| Parameter | Required | Default | Description |

|---|---|---|---|

| `subscription-id` | No | Active CLI context | Azure subscription used for subscription-scope discovery and context setting |

| `resource-group-name` | No | None | Azure resource group used for resource-group-scope discovery |

| `resource-id` | No | None | One or more Azure ARM resource IDs used for specific-resource-scope discovery |

At least one of `subscription-id`, `resource-group-name`, or `resource-id` is required.

Step-by-Step Workflows

1) Collect Required Scope (Mandatory)

Request one of these scopes before running discovery commands:

- Subscription scope: `<subscription-id>`

- Resource group scope: `<resource-group-name>`

- Specific resources scope: one or more `<resource-id>` values

Scope handling rules:

- Treat Azure ARM resource IDs (for example `/subscriptions/.../providers/...`) as cloud resource identifiers, not local file system paths.

- Use resource IDs only with Azure CLI `--ids` arguments (for example `az resource show --ids <resource-id>`).

- Never pass resource IDs to file-reading commands (`cat`, `ls`, `read_file`, glob searches) unless the user explicitly says they are local file paths.

- If the user already provided one valid scope, do not ask for additional scope inputs unless required by a failing command.

- Do not ask follow-up questions that can be answered from already-provided scope values.

If scope is missing, ask for it explicitly and stop.

2) Authenticate and Set Context

Run only the commands required for the selected scope.

For subscription scope:

az login
az account set --subscription <subscription-id>
az account show --query "{subscriptionId:id, name:name, tenantId:tenantId}" -o json

Expected output: JSON object with `subscriptionId`, `name`, and `tenantId`.

For resource group or specific resource scope, `az login` is still required but `az account set` is optional if the active context is already correct.

When using specific resource scope, prefer direct `--ids`-based commands first and avoid extra discovery prompts for subscription or resource group unless needed for a concrete command.

3) Run Discovery Commands

Discover resources using the selected scopes. Ensure to fetch all necessary information for accurate Terraform generation.

# Subscription scope
az resource list --subscription <subscription-id> -o json

# Resource group scope
az resource list --resource-group <resource-group-name> -o json

# Specific resource scope
az resource show --ids <resource-id-1> <resource-id-2> ... -o json

Expected output: JSON object or array containing Azure resource metadata (`id`, `type`, `name`, `location`, `tags`, `properties`).

4) Resolve Dependencies Before Code Generation

Parse exported JSON and map:

- Parent-child relationships (for example: NIC -> Subnet -> VNet)

- Cross-resource references in `properties`

- Ordering for Terraform creation

IMPORTANT: Generate the following documentation and save it to a docs folder in the root of the project.

- `exported-resources.json` with all discovered resources and their metadata, including dependenci