Bringing hand-built AWS infrastructure under Terraform

The challenge

Production had been built by hand over two years by engineers who had since left. Nobody could describe the full resource inventory, staging had drifted significantly from production, and standing up a new environment was quoted internally at two weeks.

What we did

1. 1

   Inventoried what actually existed

   Audited the live account against the team's mental model. Found unattached volumes, oversized instances, and two security groups open wider than intended.

2. 2

   Imported rather than rebuilt

   Brought existing resources into Terraform state with import blocks, so the migration never required tearing anything down.

3. 3

   Refactored into modules

   Extracted networking, compute, and IAM into parameterised modules so environments differ by a variables file rather than by history.

4. 4

   Moved changes into review

   Wired terraform plan into pull requests and apply into the protected branch, making infrastructure changes reviewable like any other code.