unclick

Unclick

Unclick your cloud: turn ClickOps into OpenTofu / Terraform code.

Русская версия

Unclick finds the resources that already exist in your cloud accounts and SaaS tools and writes them out as infrastructure as code, with import blocks, so that one tofu plan adopts them:

$ unclick scan aws --config region=eu-west-1
$ cd generated/aws && tofu init && tofu plan
...
Plan: 12 to import, 0 to add, 0 to change, 0 to destroy.

Unclick continues Terraformer, which was archived on March 16, 2026. Its 44 importers are still here, on a new core that works with current providers, with OpenTofu and with Terraform.

Why Unclick

• Works with current providers. Terraformer embedded Terraform 0.12 and only spoke plugin protocol 5, so providers built on the plugin framework (Cloudflare v5 and others) failed with "Incompatible API version". Unclick speaks protocols 5 and 6.
• Works with OpenTofu. Providers installed by OpenTofu are found, and missing ones are installed with tofu init. Terraform works too.
• Configuration you can plan. Every generated resource is validated by the provider itself before it is written, and arguments the provider rejects are left out. The end-to-end tests expect tofu plan to report imports only, with no changes.
• Import blocks instead of state files. Terraformer wrote a version 3 state file, which OpenTofu and Terraform upgrade with the wrong provider address for most providers not published by HashiCorp. Unclick writes imports.tf; nothing touches your state until you apply.
• scan needs no per-resource code. It asks the provider to list what exists, the mechanism behind Terraform 1.14's query command, which OpenTofu does not have yet.

Install

Download a binary for your platform from Releases, or build it with Go 1.24 or newer:

go install github.com/Perruer/unclick@latest

Unclick needs tofu (or terraform) in PATH: it uses it to download providers, exactly as tofu init would, with your mirrors and credentials.

Two ways to find resources

scan

unclick scan aws --config region=eu-west-1
unclick scan aws --config region=eu-west-1 --types aws_vpc,aws_subnet,aws_security_group
unclick scan hashicorp/google --config project=my-project --config region=europe-west1

--config key=value sets provider arguments; credentials come from the environment, as for OpenTofu. Without --types, every type the provider can list is scanned.

import

unclick import aws --regions=eu-west-1 --resources=vpc,subnet,sg
unclick import github --owner=my-org --resources=repositories
unclick import kubernetes --resources=deployments,services
unclick import aws list        # resources an importer supports

See docs/ for every provider's options and resources. Filtering works as in Terraformer; see docs/upstream-README.md.

Output

Files go to generated/<provider>/ by default:

• provider.tf: required_providers with the right source and the provider release that was used, and the provider block.
• One .tf file per resource type.
• imports.tf: one import block per resource.

Run tofu init && tofu plan there. When the plan shows only imports, tofu apply adopts the resources without changing them.

A few providers have client-side settings that an import cannot know, such as wait_for_rollout on kubernetes_deployment. The first plan shows them as an in-place change; applying it only records the setting in the state and changes nothing in the cloud.

Providers

import supports: AliCloud, Auth0, AWS, Azure, Azure AD, Azure DevOps, Cloudflare, commercetools, Datadog, DigitalOcean, Equinix Metal, Fastly, GitHub, GitLab, Gmail filters, Google Cloud, Grafana, Heroku, Honeycomb, IBM Cloud, IONOS Cloud, Keycloak, Kubernetes, LaunchDarkly, Linode, Logz.io, Mackerel, MikroTik, Myra Security, New Relic, NS1, Octopus Deploy, Okta, Opal, OpenStack, Opsgenie, PagerDuty, PAN-OS, RabbitMQ, Tencent Cloud, Vault, Vultr, Xen Orchestra, Yandex Cloud.

Tested end to end: AWS against moto (both import and scan) and GitHub against a real account; CI also runs a Kubernetes test against kind. The other importers compile and run on the new core but have not been re-tested yet; reports are welcome.

Coming from Terraformer

Building from source

go build .                           # every provider
go build -tags slim,aws -o unclick . # only the AWS importer, much smaller
go test ./...
UNCLICK_ACC=1 go test ./internal/... # against real provider plugins

Support the project

Unclick is free and open source. If it saves you work, you can support it:

• Boosty
• USDT or TRX (TRC-20): TXUBW4e88SDTfrnJRKfbhYfFcggufbonc1
• USDT, USDC or ETH (ERC-20): 0x1378491169064702786b2E5b58c6375776177E8A
• TON or USDT on TON: UQAhI7EKzoa-JuKOfv0ULMzA3FrmpxsDkXj8Qevwj2z1cMRN

Credits and license

Unclick is based on Terraformer, created by Waze SRE and The Terraformer Authors. It is licensed under the Apache License 2.0; a few files from HashiCorp projects keep the Mozilla Public License 2.0, see NOTICE.

Unclick is an independent project, not affiliated with or endorsed by Google, HashiCorp or the OpenTofu project. Terraform is a trademark of HashiCorp. OpenTofu is a trademark of The Linux Foundation.