[AWS] IaC generator to migrate from ManagementConsole operation to CDK operation [IaC]

Introduction When using the AWS ManagementConsole to build a system using AWS services, resource definitions can be done intuitively through ManagementConsole's GUI operations. Since changes made in ManagementConsole can immediately and directly change the definition of that resource, it is useful when you want to try out some new functionality or temporarily change the configuration values to verify the operation. However, when a defined resource is spread over multiple resources and becomes a larger system, it may be easier to manage IaC to get a bird's eye view of the definitions and check the differences in configuration values. This article explains how to use the IaC Generator to migrate an AWS system created using ManagementConsole to IaC management. Advantages of changing from ManagementConsole management to IaC management Because the system configuration and resource definitions are managed by code, it is easy to manage differences Allows a bird's eye view of the system definitions at a glance without having to check multiple resource screens one by one Before applying changes to the AWS environment Before applying changes to the AWS environment, they can be tested in the local environment to avoid mixing in defects and security risks. Concerns when creating a CDK application from scratch for an existing AWS environment system It is possible to create CDK code by referring to design documents and other documents, but in that case, the design documents may not be maintained and the actual environment configuration may not match the description in the design documents. However, in such cases, the design document may not be maintained, and there is a concern that writing code based on the design document may result in code that differs from the actual environment. However, in cases where there are many resources, it is necessary to go back and forth between checking the resource settings screen and writing the CDK code, which can be time-consuming and labor-intensive. ## Introduction When using the AWS ManagementConsole to build a system using AWS services, resource definitions can be done intuitively through ManagementConsole's GUI operations. Since changes made in ManagementConsole can immediately and directly change the definition of that resource, it is useful when you want to try out some new functionality or temporarily change the configuration values to verify the operation. However, when a defined resource is spread over multiple resources and becomes a larger system, it may be easier to manage IaC to get a bird's eye view of the definitions and check the differences in configuration values. This article explains how to use the IaC Generator to migrate an AWS system created using ManagementConsole to IaC management. Advantages of changing from ManagementConsole management to IaC management Because the system configuration and resource definitions are managed by code, it is easy to manage differences Allows a bird's eye view of the system definitions at a glance without having to check multiple resource screens one by one Before applying changes to the AWS environment Before applying changes to the AWS environment, they can be tested in the local environment to avoid mixing in defects and security risks. Concerns when creating a CDK application from scratch for an existing AWS environment system It is possible to create CDK code by referring to design documents and other documents, but in that case, the design documents may not be maintained and the actual environment configuration may not match the description in the design documents. However, in such cases, the design document may not be maintained, and there is a concern that writing code based on the design document may result in code that differs from the actual environment. However, in cases where there are many resources, it is necessary to go back and forth between checking the resource settings screen and writing the CDK code, which can be time-consuming and labor-intensive. 1. display the IaC Generator console screen Select “IaC Generator” from the left menu of the CloudFormation console screen 2. Select the scan mode Selecting the “Start a new scan” button will display the scan mode choices Selecting “Scan all resources” will scan all resources of the AWS account you are signed in to. Selecting “Scan Specific Resources” will allow you to select the type of resource (Lambda, StepFunctions, etc.) and scan only the selected resource(s). Scanning takes about 10 minutes for 1,000 resources. Scanning is free, so the first time you select " Scan All“ will scan all resources, and if there are resources that have been modified, you can select them in ”Scan Specific Resources". 3. Checking scan results Scan results are displayed in a pie chart and categorized by resource type The pie chart shows the percentage of each scanned

Apr 6, 2025 - 00:14

[AWS] IaC generator to migrate from ManagementConsole operation to CDK operation [IaC]

Introduction

When using the AWS ManagementConsole to build a system using AWS services, resource definitions can be done intuitively through ManagementConsole's GUI operations.
Since changes made in ManagementConsole can immediately and directly change the definition of that resource, it is useful when you want to try out some new functionality or temporarily change the configuration values to verify the operation.
However, when a defined resource is spread over multiple resources and becomes a larger system, it may be easier to manage IaC to get a bird's eye view of the definitions and check the differences in configuration values.
This article explains how to use the IaC Generator to migrate an AWS system created using ManagementConsole to IaC management.

Advantages of changing from ManagementConsole management to IaC management

Because the system configuration and resource definitions are managed by code, it is easy to manage differences
Allows a bird's eye view of the system definitions at a glance without having to check multiple resource screens one by one
Before applying changes to the AWS environment Before applying changes to the AWS environment, they can be tested in the local environment to avoid mixing in defects and security risks.

Concerns when creating a CDK application from scratch for an existing AWS environment system

It is possible to create CDK code by referring to design documents and other documents, but in that case, the design documents may not be maintained and the actual environment configuration may not match the description in the design documents. However, in such cases, the design document may not be maintained, and there is a concern that writing code based on the design document may result in code that differs from the actual environment.
However, in cases where there are many resources, it is necessary to go back and forth between checking the resource settings screen and writing the CDK code, which can be time-consuming and labor-intensive. ## Introduction When using the AWS ManagementConsole to build a system using AWS services, resource definitions can be done intuitively through ManagementConsole's GUI operations. Since changes made in ManagementConsole can immediately and directly change the definition of that resource, it is useful when you want to try out some new functionality or temporarily change the configuration values to verify the operation. However, when a defined resource is spread over multiple resources and becomes a larger system, it may be easier to manage IaC to get a bird's eye view of the definitions and check the differences in configuration values. This article explains how to use the IaC Generator to migrate an AWS system created using ManagementConsole to IaC management.

Advantages of changing from ManagementConsole management to IaC management

Because the system configuration and resource definitions are managed by code, it is easy to manage differences
Allows a bird's eye view of the system definitions at a glance without having to check multiple resource screens one by one
Before applying changes to the AWS environment Before applying changes to the AWS environment, they can be tested in the local environment to avoid mixing in defects and security risks.

Concerns when creating a CDK application from scratch for an existing AWS environment system

It is possible to create CDK code by referring to design documents and other documents, but in that case, the design documents may not be maintained and the actual environment configuration may not match the description in the design documents. However, in such cases, the design document may not be maintained, and there is a concern that writing code based on the design document may result in code that differs from the actual environment.
However, in cases where there are many resources, it is necessary to go back and forth between checking the resource settings screen and writing the CDK code, which can be time-consuming and labor-intensive.

1. display the IaC Generator console screen

Select “IaC Generator” from the left menu of the CloudFormation console screen

2. Select the scan mode

Selecting the “Start a new scan” button will display the scan mode choices
Selecting “Scan all resources” will scan all resources of the AWS account you are signed in to.
Selecting “Scan Specific Resources” will allow you to select the type of resource (Lambda, StepFunctions, etc.) and scan only the selected resource(s).
Scanning takes about 10 minutes for 1,000 resources.
Scanning is free, so the first time you select " Scan All“ will scan all resources, and if there are resources that have been modified, you can select them in ”Scan Specific Resources".

3. Checking scan results

Scan results are displayed in a pie chart and categorized by resource type
The pie chart shows the percentage of each scanned resource type at a glance, and the list view shows the names of the resources that were scanned.

4. Create CloudFormation template

Create a CloudFormation template from the scanned resources ↓ Select the “Create Template” button to go to the template creation screen

The first step is to set the name of the template and the deletion and replacement policies
- Deletion policy “Retain”: Retain the resource without deleting it when the stack is deleted or rolled back
- Replacement policy “Retain”: When a stack replacement (recreate the resource and generate a new physical ID) occurs Retain the resource without deleting it
Select “Update existing stack template” when updating with a newly scanned resource definition for a previously created template

↓Template creation screen

In Step 2, select the resources you want to include in the template from the scanned resources.
In Step 3, “Add Related Resources” section, related resources, such as roles for the resource selected in the “Add Scanned Resource” section, are suggested as options.

5. download the template

Once the template is created, download the CloudFormation template You can choose between JSON or YAML as the template format

This screen also suggests steps to convert CloudFormation template screens to AWS CDK Copy the CDK conversion commands from this screen and use them in the conversion step ↓AWS CDK Conversion Steps Suggested Screen

6. Convert CloudFormation template to AWS CDK application

Run the CDK conversion command in your local environment.

As a result of the command execution, a CDK application will be created

↓ Folder of the created CDK application

In the resulting CDK application, files and folders necessary for the CDK application other than the converted code (TypeScript in this case) will also be created.

↓Folder structure

The converted TypeScript code is almost the same L1 construct as in CloudFormation
It is possible to operate with the L1 construct, but to take advantage of the benefits of CDK, such as abstraction, you need to manually convert it to an L2 construct from here.

↓CloudFormation template before conversion

↓CDK code after conversion

Finally,

If you are familiar with CDK, it may be faster to create a CDK application from scratch without using the IaC Generator, but the IaC Generator makes it easier for people who are not familiar with CDK to create CDK applications, so consider using it depending on your team's CDK proficiency level. Please consider using the IaC Generator depending on your team's CDK skills and other factors.