inherit

Inherited an AWS account that isn't infrastructure-as-code? Start here.

One open-source binary. It runs on your machine, reads your account with read-only APIs, and writes a Terraform/OpenTofu project you can plan and import. Nothing is uploaded anywhere.

A simulated account, paced to real timings.

$ inherit scan --profile demo
found 207 resources across 17 regions
  pruned 155 default + 34 singleton resources
  18 resources across 2 regions kept
  16 resources across 7 modules, 18 import blocks

$ inherit plan inherit-999999999999
Plan: 18 to import, 0 to add, 0 to change, 0 to destroy.

$ inherit import --fast inherit-999999999999
No changes. Your infrastructure matches the configuration.

What you get

Real HCL, laid out as a root module calling one module per category. IDs that point at other discovered resources become references; anything outside the scan becomes a variable. Every resource gets an import block.

modules/network/main.tf

resource "aws_security_group" "main" {
  description = "ssh from the office"
  name        = var.security_group_name
  vpc_id      = aws_default_vpc.main.id
}

resource "aws_vpc_security_group_ingress_rule" "main" {
  cidr_ipv4         = "198.51.100.42/32"
  from_port         = 22
  ip_protocol       = "tcp"
  security_group_id = aws_security_group.main.id
  to_port           = 22
}

main.tf

module "compute" {
  source          = "./modules/compute"
  network_main_id = module.network.main_id  # cross-module wiring
  subnet_id       = "subnet-0fff5555666677778"
}

imports.tf

import {
  to = module.network.aws_security_group.main
  id = "sg-0bbb22223333cccc2"
}

Read-only, local, auditable

• Every AWS request passes a signing-time guard that rejects anything but read operations before it leaves the process.
• It runs on your machine with your credentials. No account, no telemetry, no upload.
• Secrets (Lambda env vars, user data, plain SSM values) stay out of the .tf files: they land in a gitignored local file and the attributes go under ignore_changes.
• import only ever calls the provider's Read. import --fast applies a batch only after verifying its plan is nothing but no-op imports.
• Apache-2.0. Go, one static binary.

Limits

• Covers 363 of the AWS provider's 1,735 resource types: the common ones first.
• Lambda code can't be read back from AWS, so functions point at a placeholder zip.
• A few provider-only settings show a one-time diff after import.

Details, coverage and internals are in the GitHub repo.

Install

$ curl -fsSL https://raw.githubusercontent.com/virtualbeck/inherit/main/install.sh | sh

Or go install github.com/virtualbeck/inherit/cmd/inherit@latest, or grab a binary from Releases (Linux, macOS, Windows). plan and import need OpenTofu or Terraform.