fastly-terraformer

fastly-terraformer is a specialized tool that generates Terraform import blocks for Fastly Edge Cloud resources. It automatically discovers your existing Fastly infrastructure and creates the necessary Terraform import statements to bring those resources under Terraform management.

Features

Comprehensive Resource Discovery: Automatically detects and imports multiple types of Fastly resources
Two Import Modes: Choose between importing all resources or only NGWAF (Next-Gen WAF) resources
Robust Naming: Intelligent resource name generation with sanitization for Terraform compatibility
Workspace-Scoped NGWAF: Full support for workspace-scoped NGWAF resources with conflict prevention
Error Handling: Graceful error handling with detailed logging and progress reporting

Supported Resources (Imported)

Fastly Core Services

✅ fastly_service_vcl - VCL services (whole service; domains, backends, request settings, response objects, health checks, directors, ACLs, dictionaries, snippets, custom VCL files, and logging endpoints are all nested blocks of this resource and are populated by terraform plan -generate-config-out, not by a separate import block)
✅ fastly_service_compute - Compute (WASM) services (same nested-block note as above)
✅ fastly_service_dynamic_snippet_content - Dynamic snippets for VCL services

Fastly Store Resources

✅ fastly_configstore - Config store resources
✅ fastly_configstore_entries - Config store key/value entries
✅ fastly_kvstore - Key-value store resources
✅ fastly_secretstore - Secret store resources

Fastly Object Storage

✅ fastly_object_storage_access_keys - Object Storage access keys

Note: Object Storage buckets and their contents are not managed by the Fastly Terraform provider and are therefore not imported by this tool. Maintain them with the AWS S3 provider using Fastly Object Storage's S3-compatible API, as described in the provider guide. Also note that the secret_key of an access key is only returned by the Fastly API at creation time, so it cannot be recovered by importing an existing access key.

TLS and Security

✅ fastly_tls_subscription - TLS subscriptions
✅ fastly_tls_activation - TLS certificate activations
✅ fastly_tls_certificate - TLS certificates
✅ fastly_tls_configuration - TLS configurations
✅ fastly_tls_private_key - TLS private keys

Account-Level Resources

✅ fastly_user - User management
✅ fastly_service_authorization - Service authorization tokens

NGWAF Account-Level Resources

✅ fastly_ngwaf_workspace - NGWAF workspace management
✅ fastly_ngwaf_account_list - Account-level lists
✅ fastly_ngwaf_account_rule - Account-level rules
✅ fastly_ngwaf_account_signal - Account-level signals

NGWAF Workspace-Scoped Resources

✅ fastly_ngwaf_workspace_list - Workspace-specific lists
✅ fastly_ngwaf_workspace_rule - Workspace-specific rules
✅ fastly_ngwaf_workspace_signal - Workspace-specific signals

NGWAF Alert Integrations (Workspace-Scoped)

✅ fastly_ngwaf_alert_datadog_integration - Datadog alert integration
✅ fastly_ngwaf_alert_jira_integration - Jira alert integration
✅ fastly_ngwaf_alert_mailing_list_integration - Mailing list alert integration
✅ fastly_ngwaf_alert_microsoft_teams_integration - Microsoft Teams alert integration
✅ fastly_ngwaf_alert_opsgenie_integration - Opsgenie alert integration
✅ fastly_ngwaf_alert_pagerduty_integration - PagerDuty alert integration
✅ fastly_ngwaf_alert_slack_integration - Slack alert integration
✅ fastly_ngwaf_alert_webhook_integration - Webhook alert integration

NGWAF Additional Workspace Resources

✅ fastly_ngwaf_redaction - Data redaction rules
✅ fastly_ngwaf_thresholds - Rate limiting thresholds
✅ fastly_ngwaf_virtual_patches - Virtual security patches

Currently Unsupported Resources (Not Imported)

The following Fastly provider resources are not currently imported by this tool:

Core Fastly Resources

❌ fastly_service_waf_configuration - Legacy WAF configurations

Note: Legacy WAF configurations are not accessible through the current Fastly API. If you need WAF functionality, consider using the modern NGWAF resources which are fully supported by this tool.

Prerequisites

Go 1.24.4+ (as specified in go.mod)
Fastly API Token with appropriate permissions
Terraform (for applying the generated import configuration)

Installation

Download Pre-built Binary

Download the latest release for your platform from the Releases page.

Replace VERSION below with the desired version (e.g., v1.0.0):

# For Linux (amd64)
VERSION=v1.0.0  # Replace with desired version
curl -L -o fastly-terraformer.tar.gz "https://github.com/fastly/fastly-terraformer/releases/download/${VERSION}/fastly-terraformer_${VERSION#v}_linux_amd64.tar.gz"
tar -xzf fastly-terraformer.tar.gz
chmod +x fastly-terraformer

# For macOS (arm64)
VERSION=v1.0.0  # Replace with desired version
curl -L -o fastly-terraformer.tar.gz "https://github.com/fastly/fastly-terraformer/releases/download/${VERSION}/fastly-terraformer_${VERSION#v}_darwin_arm64.tar.gz"
tar -xzf fastly-terraformer.tar.gz
chmod +x fastly-terraformer

Build from Source

Clone the repository and build the tool:

git clone https://github.com/fastly/fastly-terraformer.git
cd fastly-terraformer
go mod tidy
go build -o fastly-terraformer

Usage

Environment Variables

Set your Fastly API token:

export FASTLY_API_KEY="your-fastly-api-token-here"

For Terraform generation with sensitive fields:

export FASTLY_TF_DISPLAY_SENSITIVE_FIELDS="true"

Command Line Options

The tool supports two import modes and an optional service filter:

# Import all resources (default)
./fastly-terraformer
./fastly-terraformer -import all

# Import only NGWAF resources  
./fastly-terraformer -import ngwaf

# Import only a specific VCL service (and its associated sub-resources)
./fastly-terraformer -vcl-service-id SERVICE_ID

# Show help
./fastly-terraformer -help

`-vcl-service-id SERVICE_ID`

Restricts the import to a single VCL service, identified by its Fastly service ID. This is useful when you want to bring one service under Terraform management without importing your entire account.

Behavior:

Only applicable with -import all mode (the default). If used with -import ngwaf, the flag is ignored and a warning is printed.
The specified service must exist and must be a VCL service (not a Compute service). The tool returns an error if the ID is not found or belongs to a non-VCL service.
NGWAF imports are automatically skipped when this flag is set, because the import is scoped to a single service.

Example:

export FASTLY_API_KEY="your-fastly-api-token-here"
./fastly-terraformer -import all -vcl-service-id abc123def456

Complete Workflow

Generate import blocks:

export FASTLY_API_KEY="your-token"
export FASTLY_TF_DISPLAY_SENSITIVE_FIELDS="true"
./fastly-terraformer

Generate Terraform configuration:

terraform init
terraform plan -generate-config-out=generated.tf

Review and apply:

# Review the generated files
cat import.tf generated.tf

# Apply the import
terraform apply

Makefile Shortcuts

The repository includes convenient Make targets:

# Clean previous runs and import all resources
make rerun

# Clean previous runs and import only NGWAF resources  
make rengwaf

# Build and run
make run

# Clean generated files
make clean

Output Files

import.tf - Contains all the Terraform import blocks
generated.tf - Contains the resource configurations (generated by terraform plan -generate-config-out)

Example Output

Import Blocks (`import.tf`)

import {
  id = "abc123def456"
  to = fastly_service_vcl.my_service
}

import {
  id = "workspace-123/list-456"
  to = fastly_ngwaf_workspace_list.ws_abc123def456_custom_blocklist_list_456
}

import {
  id = "workspace-123/alert-789"
  to = fastly_ngwaf_alert_slack_integration.ws_abc123def456_security_alerts_alert_789
}

Resource Naming

The tool uses intelligent naming conventions:

Services: Uses service name, falls back to service ID
NGWAF Account Resources: Uses descriptive names (list name, rule description, etc.)
NGWAF Workspace Resources: Prefixed with workspace ID to prevent conflicts
- Format: {sanitized_workspace_id}_{resource_name}_{sanitized_resource_id}
- Example: ws_prod_tf_ngwaf_security_alerts_alert_789

Resource Discovery Process

For "all" Mode:

Fastly Services: Discovers all VCL and Compute services
Dynamic Snippets: For each VCL service, finds all dynamic snippets
NGWAF Resources: Discovers all NGWAF resources (same as "ngwaf" mode)

For "ngwaf" Mode:

Workspaces: Lists all available NGWAF workspaces
Account-Level: Lists account-scoped lists, rules, and signals
Workspace-Scoped: For each workspace, discovers:
- Workspace-specific lists, rules, and signals
- Alert integrations (all types)
- Redactions, thresholds, and virtual patches

Error Handling

The tool includes robust error handling:

API Errors: Logged but don't stop processing other resources
Empty/Invalid IDs: Resources with missing IDs are skipped
Access Issues: Graceful degradation if workspace access fails
Service Discovery: Continues processing if individual services fail

Testing

Run the comprehensive test suite:

go test -v

Tests cover:

Resource name sanitization
Fallback behavior for empty names
Special character handling
Import function signatures
Workspace-prefixed resource name generation

Troubleshooting

Common Issues

"FASTLY_API_KEY environment variable not set"
- Ensure you've exported your Fastly API token: export FASTLY_API_KEY="your-token"
"No services/workspaces found"
- Verify your API token has the necessary permissions
- Check that you have resources in your Fastly account
Empty import.tf file
- The tool may not have found any importable resources
- Check the console output for error messages
Import ID format errors
- Workspace resources use format: workspace-id/resource-id
- Account resources use format: resource-id
- Service dynamic snippets use format: service-id/snippet-id

Debug Tips

Run with verbose output to see detailed discovery process
Check the console summaries showing discovered resources
Verify generated import.tf file has expected resource references
Use terraform plan to validate import IDs before applying

Contributing

Fork the repository
Create a feature branch
Add tests for new functionality
Ensure all tests pass: go test -v
Submit a pull request

License

This project is licensed under the terms specified in the repository.

Name		Name	Last commit message	Last commit date
.github		.github
.gitignore		.gitignore
.goreleaser.yaml		.goreleaser.yaml
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
SECURITY.md		SECURITY.md
go.mod		go.mod
go.sum		go.sum
main.go		main.go
main_test.go		main_test.go
providers.tf		providers.tf

Latest commit

History

Folders and files

Repository files navigation