# aztfexport runs terraform import for you and then writes the HCL

> aztfexport is Microsoft's Go tool that pulls existing Azure resources into Terraform state and generates configuration for them, so `terraform plan` comes back clean. It is a migration aid with an explicit non-goal: the generated config is not meant to reproduce the infrastructure from scratch.

**Azure/aztfexport** — A tool to bring existing Azure resources under Terraform's management

- Repository: https://github.com/Azure/aztfexport
- Website: https://azure.github.io/aztfexport/
- Stars: 1,917 · Forks: 223
- Language: Go
- License: MPL-2.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/azure-aztfexport

## The success condition is an empty plan, not a complete config

The goal is stated precisely: export supported resources into Terraform state and generate the matching configuration, with the expectation that state and configuration agree with the real remote resources so `terraform plan` shows no diff. Once that holds, Terraform manages the resources normally.

The non-goal matters just as much. The generated configurations are not meant to be comprehensive and do not ensure the infrastructure can be fully reproduced from them. This is the line between an import aid and a codebase-as-source-of-truth tool, and the README puts it in its own section rather than burying it.

Both Terraform providers are supported: the Terraform AzureRM provider and the Terraform AzAPI provider. 

Licensing is MPL-2.0, file-level copyleft, which is comfortable for a tool you run against a subscription.

## It is three programs: aztft, terraform import, tfadd

The mechanism is a pipeline of three steps.

First, `aztft` from magodo identifies the correct Terraform AzureRM provider resource type for a given Azure resource ID. Second, aztfexport runs `terraform import` under the hood for each resource it has classified. Third, `tfadd`, also from magodo, generates the Terraform HCL for every imported resource from the resulting state.

The repository layout shows the same split. Alongside `main.go`, `flag.go`, `cred.go` and `auth_oidc.go` sit `pkg/` and `internal/`, and the module requires `github.com/magodo/aztft` and `github.com/magodo/tfadd` directly, plus `terraform-exec`, `terraform-json` and `hc-install` from HashiCorp. The presence of `terraform-exec` is the key detail: aztfexport shells out to a real terraform binary rather than emulating one, which is why the terraform prerequisite exists.

`azlist`, `armid`, `tfstate` and `workerpool` are also dependencies, which suggests resource enumeration and parallel import rather than a strictly serial loop.

## Installing it: four package managers, one prerequisite

There is a precompiled binary and a Windows MSI on the Releases page, and a Go toolchain route:

```bash
go install github.com/Azure/aztfexport@latest
```

The module declares `go 1.25.0`, so a local build needs a recent toolchain. Package managers cover the common cases:

```bash
winget install aztfexport
brew install aztfexport
```

On RPM systems the documented route adds the Microsoft repository first, importing the key and then installing the repo package for the RHEL major version, 8 or 9, before `dnf install aztfexport`. The apt route is the same shape with `curl -sSL https://packages.microsoft.com/keys/microsoft.asc` piped into `/etc/apt/trusted.gpg.d/` and `apt-add-repository` for 20.04 or 22.04. Arch users have `yay -S aztfexport` from the AUR. Supported apt and dnf versions and architectures are listed explicitly: Ubuntu 20.04 and 22.04 on amd64 and arm64, RHEL 8 and 9 on amd64 and arm64.

The prerequisite is short and easy to miss: a `terraform` executable in `$PATH` at version `>= v0.12`.

## The config file exists mostly to turn telemetry off

aztfexport writes a configuration file at `$HOME/.aztfexport/config.json` on first run, and the README manages it through a `config` subcommand with three verbs: `get`, `set` and `show`.

Only two items are documented. `installation_id` is a UUID created on first run, and if Azure CLI or Azure PowerShell is installed on the machine the same UUID is shared across those tools, otherwise a new one is generated. It is used as an identifier in the telemetry trace. `telemetry_enabled` is the switch, and the README states plainly that it can be set to false.

That is worth pausing on. The shared UUID across Azure CLI and Azure PowerShell means the identifier is not per-tool in the common case, and the tool depends on Application Insights, visible as `github.com/microsoft/ApplicationInsights-Go` in the module requirements. Anyone with a policy against outbound telemetry should review the tool's telemetry setting before the first export.

Authentication is handled in the tool's own code, with `cred.go` and `auth_oidc.go` at the repository root suggesting both credential-chain and OIDC paths.

## Where it will not help, and what to compare it against

The limits are documented elsewhere. The README does not enumerate them; it links to a limitations section in the Azure Export for Terraform documentation on Microsoft Learn. Given the non-goal above, expect gaps in generated configuration for anything where Azure's runtime state carries more than the provider schema, and expect child resources of a parent to need separate handling.

The comparison that matters is with a hand-run import. Running `terraform import` per resource ID gives you state but leaves you to write HCL, which is tedious and error prone across a subscription. aztfexport does both steps and adds the resource type lookup, at the cost of trusting a generated file you did not write. A third path is leaving the resources in Azure and only adopting Terraform for new work, which avoids the migration entirely and leaves the estate split.

Maintenance is healthy. The last push was on 2026-10-03 and v0.20.0 shipped on 2026-07-17, after v0.19.0 in January 2026 and v0.18.0 in June 2025. CI enforces dependency hygiene through a `depscheck` target that runs `go mod tidy` and fails if `go.mod` or `go.sum` change.

## Conclusion

Adopt aztfexport when you have Azure resources created outside Terraform and need them in state so a plan shows no diff, since it automates the type lookup and the config generation that a hand-run import leaves out. Do not adopt it as a way to generate reproducible infrastructure, because the README rules that out as a non-goal and defers to a limitations page on Microsoft Learn. Verify first that terraform >= v0.12 is on `$PATH`, that the credentials aztfexport finds match the subscription you intend to export, and whether the resources you care about appear in the known limitations list.

## FAQ

### How do I install aztfexport?

Use `go install github.com/Azure/aztfexport@latest`, `winget install aztfexport` on Windows, `brew install aztfexport` on Linux or macOS, `yay -S aztfexport` from the AUR, or the documented dnf and apt repository steps. Precompiled binaries and a Windows MSI are also on the Releases page.

### What does aztfexport need before it will run?

A `terraform` executable in `$PATH` at version `>= v0.12`. It drives `terraform import` under the hood rather than emulating Terraform.

### Can I disable telemetry in aztfexport?

Yes. Run the config command to set `telemetry_enabled` to false in `$HOME/.aztfexport/config.json`. The `config` subcommand also has `get` and `show`, and `installation_id` is a UUID shared with Azure CLI and Azure PowerShell when either is installed.

### Will the configuration aztfexport generates rebuild my Azure infrastructure from scratch?

No. The README lists that as a non-goal: the generated configurations are not meant to be comprehensive and do not ensure the infrastructure can be fully reproduced from them. Known limitations are documented on Microsoft Learn.

## Sources

- [Azure/aztfexport on GitHub](https://github.com/Azure/aztfexport)
- [License: MPL-2.0](https://github.com/Azure/aztfexport/blob/main/LICENSE)
- [Project website](https://azure.github.io/aztfexport/)
- [README](https://github.com/Azure/aztfexport/blob/main/README.md)
- [Releases](https://github.com/Azure/aztfexport/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/azure-aztfexport