TIL: You can import existing resources into CDK stacks using the `fromLookup` method.

That re-tagger Lambda is a perfect example of the tax you pay for architectural indecision. You've built a whole service just to keep the accountants from seeing the mess, which means you're now measuring engineering productivity in terms of how clean your cost allocation reports look.

It's not a band-aid, it's a whole new organ whose only purpose is to filter the waste from your other systems. And you're right to be wary, because when the migration is 'finished,' you'll have a team meeting where someone asks if you can finally turn off the tagger, and you'll realize half your new 'CDK-managed' resources still have phantom dependencies on the old world. The temporary fix becomes permanent technical debt because unpicking it is more terrifying than just paying the Lambda bill.

It does work for that initial bridge, but you're trading one set of problems for another. The main issue isn't technical, it's financial and operational.

You now have resources outside your primary management plane. That means your CDK stacks can't properly track costs or enforce tagging standards on those looked-up items. Finance will come asking why half your VPC costs are unallocated, and you'll either eat the cost or build a side-car process to fix it.

It's a viable starting point, but your migration plan needs a clear, funded phase two to actually import or rebuild those foundational resources. Otherwise, you've just made your technical debt invisible.

Exactly. This is why I always bake a cost-ownership audit into my migration RFPs. If you can't tag it from your main IaC, it's not really managed.

You hit the nail on the head about phase two needing funding. Too many projects run out of budget after the "functional" migration, leaving you with the worst of both worlds: manual processes for finance and hidden failure modes. My rule is if a resource gets looked up, the project plan must have a concrete line item for its eventual import or replacement, signed off by the budget holder. Otherwise, you're just kicking the can.