CLI Commands Reference
Complete reference for all Terraback commands.
Command Structure
terraback [OPTIONS] COMMAND [ARGS]
Global Options
| Option | Description |
|---|---|
--verbose, -v | Enable verbose output |
--debug | Enable debug logging |
--help | Show help message |
Top-Level Commands
| Command | Description |
|---|---|
aws | Amazon Web Services resources |
azure | Microsoft Azure resources |
gcp | Google Cloud Platform resources |
scan | Resource scanning commands |
terraform | Terraform operations |
clean | Clean generated files |
list | List scanned resources |
analyse | Analyse Terraform state |
license | License management |
cache | Cache management |
Scan Commands
scan all
Scan all resources in a cloud provider.
terraback scan all PROVIDER [OPTIONS]
Arguments:
PROVIDER: Cloud provider (aws,azure, orgcp)
Options:
| Option | Description |
|---|---|
-o, --output-dir PATH | Directory to save Terraform files (default: generated) |
-p, --profile TEXT | AWS profile name |
-r, --region TEXT | AWS region, Azure location, or GCP region |
-s, --subscription-id TEXT | Azure subscription ID |
--project-id TEXT | GCP project ID |
-g, --resource-group TEXT | Azure resource group |
-z, --zone TEXT | GCP zone |
--with-deps | Recursively scan dependencies (Professional) |
--parallel INTEGER | Number of parallel workers (1-32) |
--enterprise-modules | Generate enterprise module structure (Professional) |
--cache / --no-cache | Cache API responses for faster re-scans. Opt-in: caching is OFF by default (--no-cache) |
--cache-encrypt | Encrypt cache files at rest with Fernet (requires --cache) |
--all-regions | Scan all enabled regions/locations in parallel instead of a single region (Professional) |
--resume | Resume an interrupted scan, skipping scanners that already completed |
--preview | Run a terraform plan preview after the scan completes |
Examples:
# Scan all AWS resources in us-east-1
terraback scan all aws -r us-east-1 -o ./output
# Scan with dependencies and enterprise modules
terraback scan all aws -r us-east-1 --with-deps --enterprise-modules -o ./enterprise
# Scan Azure resource group
terraback scan all azure -g my-resource-group -o ./azure-output
# Scan GCP project
terraback scan all gcp --project-id my-project -r us-central1 -o ./gcp-output
# Scan all enabled AWS regions in parallel, caching API responses
terraback scan all aws --all-regions --parallel 8 --cache -o ./output
# Resume an interrupted scan
terraback scan all aws -r us-east-1 --resume -o ./output
scan auth-check
Check authentication status for all cloud providers.
terraback scan auth-check
AWS Commands
aws scan-all
Scan all available AWS resources based on your license tier.
terraback aws scan-all [OPTIONS]
Service-Specific Commands
Each AWS service has resource-specific commands for scanning, listing, and importing. For example, the EC2 service has scan-instances, list-instances, import-instance, scan-volumes, etc.
Available Services:
| Service | Description |
|---|---|
ec2 | EC2 instances, volumes, snapshots, AMIs, key pairs |
vpc | VPCs, subnets, security groups, route tables, gateways |
s3 | S3 buckets, versioning, public access blocks |
iam | IAM roles, policies |
rds | RDS instances, subnet groups, parameter groups |
lambda | Lambda functions, layers |
elbv2 | Application/Network Load Balancers, target groups, listeners |
elb | Classic Load Balancers |
route53 | Hosted zones, DNS records |
sns | SNS topics, subscriptions |
sqs | SQS queues |
acm | ACM certificates |
apigateway | API Gateway REST APIs |
autoscaling | Auto Scaling groups, policies, launch configurations |
cloudfront | CloudFront distributions, origin access controls |
cloudwatch | Log groups, alarms, dashboards |
ecr | ECR repositories |
ecs | ECS clusters, services, task definitions |
efs | EFS file systems, mount targets, access points |
eips | Elastic IPs |
elasticache | ElastiCache clusters, replication groups |
secretsmanager | Secrets Manager secrets |
ssm | SSM parameters, documents |
dynamodb | DynamoDB tables |
kms | KMS keys, aliases |
eventbridge | EventBridge rules, targets |
stepfunctions | Step Functions state machines |
kinesis | Kinesis streams, Firehose delivery streams |
opensearch | OpenSearch domains |
msk | MSK clusters |
cloudtrail | CloudTrail trails |
guardduty | GuardDuty detectors |
backup | AWS Backup vaults |
Example Usage:
# Scan EC2 instances
terraback aws ec2 scan-instances --region us-east-1 --output-dir ./output
# Scan EC2 instances with dependencies
terraback aws ec2 scan-instances --region us-east-1 --with-deps --output-dir ./output
# List previously scanned EC2 instances
terraback aws ec2 list-instances --output-dir ./output
# Import a specific EC2 instance
terraback aws ec2 import-instance i-1234567890abcdef0 --output-dir ./output
Azure Commands
azure scan-all
Scan all available Azure resources.
terraback azure scan-all [OPTIONS]
Service-Specific Commands
Azure services are organized by category. Use terraback azure CATEGORY to access service-specific commands.
| Service | CLI Command | Description |
|---|---|---|
| Compute | compute | Virtual machines, managed disks, VM scale sets, SSH keys, function apps, App Service plans, web apps |
| Network | network | Virtual networks, subnets, network interfaces, NSGs, public IPs, NAT gateways, route tables |
| Storage | storage | Storage accounts, file shares |
| Database | database | SQL servers, SQL databases, SQL elastic pools |
| Container | container | Kubernetes clusters, container registries |
| Security | security | Key vaults, role assignments, role definitions, user-assigned identities |
| Load Balancer | lb | Load balancers, application gateways |
| Caching | caching | Redis Cache instances |
| CDN | cdn | CDN profiles, CDN endpoints |
| DNS | dns | DNS zones, DNS records |
| Messaging | messaging | Service Bus namespaces, queues, topics, subscriptions, Event Hub namespaces |
| Monitoring | monitor | Log Analytics workspaces, action groups, metric alerts, portal dashboards |
| Integration | integration | API Management instances, APIs |
| Resources | resources | Resource groups |
Example Usage:
# Scan VMs in a resource group
terraback azure compute vm scan -g my-resource-group --output-dir ./output
# Scan all Azure resources
terraback azure scan-all -g my-resource-group --output-dir ./output
GCP Commands
gcp scan-all
Scan all available GCP resources.
terraback gcp scan-all [OPTIONS]
Service-Specific Commands
| Service | CLI Command | Description |
|---|---|---|
| Compute Engine | compute | Instances, disks, instance templates |
| Network | network | VPC networks, subnets, firewall rules, routers, NAT gateways |
| Storage | storage | Cloud Storage buckets, Filestore instances |
| GKE | gke | Kubernetes clusters, node pools |
| Cloud SQL | sql | SQL instances, SQL databases |
| Cloud Functions | functions | Cloud Functions |
| Pub/Sub | pubsub | Topics, subscriptions |
| Cloud Run | cloudrun | Cloud Run services |
| Load Balancer | loadbalancer | Backend services, URL maps, target proxies, forwarding rules |
| Secrets | secrets | Secrets |
| Caching | caching | Memorystore Redis and Memcached instances |
| Security | security | KMS key rings, crypto keys, Certificate Authority, Binary Authorization |
| Container Registry | containerregistry | Container registries |
| Certificate Manager | certificatemanager | Certificates, certificate maps |
| Messaging | messaging | Cloud Tasks queues |
| Integration | integration | API gateways, Workflows, Eventarc triggers |
| Database | database | Firestore, Bigtable, Spanner |
Example Usage:
# Scan compute instances
terraback gcp compute scan-all --project-id my-project --region us-central1 --output-dir ./output
# Scan all GCP resources
terraback gcp scan-all --project-id my-project --region us-central1 --output-dir ./output
Import Commands
After a scan, bring the discovered resources under Terraform management with the
provider-level import command. This is the fast path: with Terraform 1.5+ it uses
import blocks to import every resource in a single operation instead of one
terraform import call per resource.
terraback <aws|azure|gcp> import [OPTIONS]
Options:
| Option | Description |
|---|---|
-o, --output-dir PATH | Directory containing the generated import files (default: generated) |
-t, --terraform-dir PATH | Terraform working directory (defaults to --output-dir) |
-m, --method TEXT | Import method: auto (detect best), bulk (fastest, Terraform 1.5+), or sequential (one-by-one, most reliable). Default: auto |
--plan-check | Run a full terraform plan validation before importing; aborts on drift |
--allow-drift | Allow import to proceed even when --plan-check detects drift |
-y, --yes | Skip the confirmation prompt |
Examples:
# Auto-detect the best method and import everything (with confirmation)
terraback aws import -o ./output
# Force bulk import (Terraform 1.5+ import blocks), no prompt
terraback aws import -o ./output --method bulk --yes
# Validate with a plan first, abort if drift is detected
terraback azure import -o ./output --plan-check
See the Import Guide for the full workflow and method comparison.
Analyse Commands
analyse state
Display the resources, modules, dependencies, and outputs in a Terraform state file, along with suggested module paths for each resource.
terraback analyse state [OPTIONS]
Options:
| Option | Description |
|---|---|
--tfstate-file PATH | Path to the .tfstate file (default: terraform.tfstate) |
analyse summary
Show a summary of the resources in a Terraform state file.
terraback analyse summary [OPTIONS]
Options:
| Option | Description |
|---|---|
--tfstate-file PATH | Path to the .tfstate file (default: terraform.tfstate) |
License Commands
license activate
Activate a license key.
terraback license activate LICENSE_KEY
license status
Show current license status.
terraback license status
license doctor
Diagnose and troubleshoot license issues.
terraback license doctor
license refresh
Force online license validation.
terraback license refresh
Cache Commands
cache stats
Show cache statistics.
terraback cache stats
cache clear
Clear all cached data.
terraback cache clear
cache invalidate
Invalidate specific cache entries.
terraback cache invalidate [OPTIONS]
Options:
| Option | Description |
|---|---|
--service TEXT | Service name to invalidate cache for |
--operation TEXT | Specific operation to invalidate |
Examples:
# Clear all EC2 cache
terraback cache invalidate --service ec2
# Clear S3 cache
terraback cache invalidate --service s3
Clean Commands
clean
Clean generated files from a directory.
terraback clean [OPTIONS]
clean all
Clean all generated files including import files.
terraback clean all [OPTIONS]
Output Files
When scanning, Terraback generates:
| File/Directory | Description |
|---|---|
*.tf | Terraform resource definitions |
provider.tf | Provider configuration |
import/ | Import command JSON files |
variables.tf | Variable definitions (enterprise modules) |
outputs.tf | Output definitions (enterprise modules) |
modules/ | Module directory (enterprise modules) |
config/ | Environment configurations (enterprise modules) |
Common Options
These options are available on terraback scan all. Service-specific commands use --region, --output-dir, --profile (without short forms).
| Option | Description | Available on |
|---|---|---|
-o, --output-dir | Directory for generated files (default: ./generated) | scan all |
-r, --region | AWS region or GCP region | scan all |
-p, --profile | AWS profile name | scan all |
-g, --resource-group | Azure resource group | scan all, Azure commands |
--project-id | GCP project ID | scan all, GCP commands |
--with-deps | Scan dependencies automatically | scan all, service commands |
--enterprise-modules | Generate organized module structure | scan all |
--parallel N | Number of parallel workers (1-32) | scan all |
--cache / --no-cache | Cache API responses (OFF by default) | scan all |
--cache-encrypt | Encrypt cache files at rest (requires --cache) | scan all |
--all-regions | Scan all enabled regions/locations in parallel | scan all |
--resume | Resume an interrupted scan | scan all |
--preview | Run terraform plan preview after scan | scan all |
Note: The table above describes scan all, where -r/--region accepts an AWS
region, Azure location, or GCP region. When using Azure commands directly
(terraback azure ..., outside of scan all), there is no --region flag — use
--location (or -l) instead.
Exit Codes
| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | Error (authentication, permission, license, or general failure) |