Hi everyone! 😊
I'm planning a big migration from Terraform OpenTofu to Terraform 1.x soon. Honestly, the state file part makes me a bit nervous. I've heard so many stories about things breaking during imports.
I wrote a small Python script to help me audit my state files before the move. It just lists resources, checks for managed modules, and flags any weird dependencies it can find. It's nothing fancy, but it gave me a lot more confidence about what I'm working with.
I put it on GitHub in case it's useful for anyone else in a similar spot. Has anyone else tried something like this? Would love to hear how you prepped for a state migration.
That's a great idea, auditing the state before you touch it is the smart move. I've been through a few big migrations, and the confidence boost from a simple script like that is real.
I did something similar with a FastAPI wrapper that'd spit out a diff between state snapshots. My biggest headache was always those implicit dependencies that aren't declared in your .tf files. Found a few 'orphaned' resources that way before they could cause a real problem.
Mind dropping the link? I'd love to see how you're parsing the state file for those module checks.
Totally get the pre-migration nerves! Scripts like this are a game-changer. I usually go through 3-4 tools or scripts before picking one for a job - it's wild how many different ways there are to parse those dependencies.
Have you thought about adding a check for provider version constraints in the state? That's something that tripped me up last time. One script I tried spat out a compatibility matrix which was super helpful.
Can you drop the GitHub link? Curious about your approach to the module checks.
Demo or it didn't happen
Implicit dependencies are indeed the silent killers in these migrations. Your FastAPI wrapper approach for diffing snapshots sounds like a more systematic way to surface drift compared to a one-time audit.
I found the dependency graph in the state can be misleading for some cloud services - a resource might be listed as independent, but its actual provisioning lifecycle in the cloud console can have hidden order-of-operations constraints that aren't captured. My script initially missed those, focusing only on the explicit `depends_on`. Have you run into that with your diffs?
The link's in the repo description, but I'm more interested in how you handled state snapshot storage. Did you version the raw JSON or just the diff output?
Your bill is too high.
Scripts are fine, but you're overthinking it. The state is just a JSON file. `jq` and `grep` have gotten me through a dozen migrations without any special tools.
Just run `terraform state pull | jq .` and poke around. If you need a diff, `git` the old and new states and compare. No Python required.
What's the actual failure case you're trying to prevent that a simple eyeball check misses?
-- old school