Terraform to AWS CDK Converter (Python)

How to convert Terraform to AWS CDK in Python

To convert Terraform to AWS CDK in Python, paste your HCL into the editor above and press Convert to CDK. You get a Stack subclass where each resource is a construct created with self as its scope. Save it as stack.py in an app made with cdk init app --language python, then run cdk synth.

1. Paste your TerraformPaste HCL into the Terraform (HCL) editor, or open a .tf or .hcl file up to 500 KB. Related resources, such as a queue and its dead-letter queue, convert best in the same paste.
2. Check for secretsBefore anything is sent, the page looks for AWS keys, private keys and tokens in your code and shows you where they are, so you can swap in placeholders.
3. Convert to CDKPress Convert to CDK or Ctrl + Enter. The Python stack streams in as it's written, and Stop ends the conversion early.
4. Save stack.pyRead through the output, search for TODO: comments, then Download it as stack.py or Copy it into your project.
5. Wire it into app.py and synthImport the class in app.py, instantiate it with your env, and run cdk synth in the activated virtual environment. A wrong keyword argument fails here, before anything is deployed.

Why rewrite Terraform as a Python CDK app

Python teams move to CDK so infrastructure lives in the same language as their Lambda handlers, data pipelines and tests. A CDK app can import your own modules, loop over a config dictionary, and be unit tested with pytest and aws_cdk.assertions, which is hard to match with HCL.

The translation isn't mechanical, though. Terraform nests settings in blocks, while CDK Python takes keyword arguments and small property classes: a redrive_policy written with jsonencode() becomes dead_letter_queue=sqs.DeadLetterQueue(...). The converter does that restructuring for a whole module at once, so you start from a stack that already reads like Python.

It helps most when you're retiring a handful of Terraform modules, splitting a monorepo, or showing a team what their existing infrastructure looks like as CDK. For TypeScript projects, use the Terraform to CDK TypeScript converter.

From HCL blocks to Python constructs

In a Python CDK app, each Terraform resource becomes a construct instantiated with self as its scope, for example sqs.Queue(self, "Orders", visibility_timeout=Duration.seconds(60)). Attribute references like aws_sqs_queue.orders_dlq.arn become Python attributes such as dlq.queue_arn, and time values use Duration instead of plain seconds.

CDK is written in TypeScript and published to Python through jsii, so the classes are identical and only the naming changes: visibilityTimeout is visibility_timeout, and enums keep their upper-case members. Because CDK synthesizes to CloudFormation, the deployed resources can differ slightly from Terraform's. AWS's guide to working with CDK in Python covers setup and conventions.

Terraform to CDK Python: quick reference

Common HCL patterns and the Python they should become.

Key features

• Pythonic outputKeyword arguments in snake_case, Duration helpers and enum members instead of raw strings and numbers.
• Nested blocks become property classesBlocks such as attribute, lifecycle_rule or a redrive policy turn into classes like dynamodb.Attribute and sqs.DeadLetterQueue.
• for_each and count become Python loopsRepeated resources are written as loops or dict comprehensions over plain Python data.
• A ready-to-use Stack classThe output is a Stack subclass with the standard __init__(self, scope, construct_id, **kwargs) signature, ready to import in app.py.
• Gaps marked with TODOAnything without a CDK equivalent, such as ignore_changes, is called out in a TODO: comment rather than guessed.
• Names and comments keptYour resource names and comments carry over, so reviewers can match each construct to the HCL it came from.
• Secret check, then streamingKeys and tokens are caught in the browser first, and the stack streams in with a Stop button.

Examples: Terraform converted to CDK Python

Two examples of HCL that changes shape in Python. Choose Try this example to load the Terraform into the converter. Your output may use different construct IDs or formatting.

resource "aws_s3_bucket" "logs" {
  bucket = "acme-app-logs"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
  bucket = aws_s3_bucket.logs.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "logs" {
  bucket = aws_s3_bucket.logs.id
  rule {
    id     = "expire-old-logs"
    status = "Enabled"
    filter {}
    expiration {
      days = 90
    }
  }
}

from aws_cdk import Stack, Duration, aws_s3 as s3
from constructs import Construct


class LogsStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        s3.Bucket(
            self,
            "Logs",
            bucket_name="acme-app-logs",
            encryption=s3.BucketEncryption.KMS_MANAGED,
            lifecycle_rules=[
                s3.LifecycleRule(
                    id="expire-old-logs",
                    expiration=Duration.days(90),
                )
            ],
        )

variable "topics" {
  type = map(string)
  default = {
    orders   = "Order events"
    invoices = "Invoice events"
  }
}

resource "aws_sns_topic" "events" {
  for_each     = var.topics
  name         = "${each.key}-events"
  display_name = each.value
}

from aws_cdk import Stack, aws_sns as sns
from constructs import Construct

TOPICS = {
    "orders": "Order events",
    "invoices": "Invoice events",
}


class EventsStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.topics = {
            key: sns.Topic(
                self,
                f"{key.capitalize()}Events",
                topic_name=f"{key}-events",
                display_name=label,
            )
            for key, label in TOPICS.items()
        }

Tips for better results

• Paste related resources together. A queue and its dead-letter queue, or a table and the function that reads its stream, convert into cleaner references in one paste.
• Leave names out where you can. An explicit queue_name="orders" stops CloudFormation from replacing the resource without deleting it first. Keep fixed names only for resources you'll import.
• Pin the library. Put an exact aws-cdk-lib version in requirements.txt so every machine and CI job synthesizes the same template.
• Test the stack. aws_cdk.assertions.Template.from_stack() lets you assert, in pytest, that the converted stack still has the properties your Terraform set.
• Run cdk synth early. jsii checks keyword arguments at synth time, so a misspelled property fails in seconds, before anything is deployed.

Common mistakes to avoid

• Importing aws_lambda as lambda. lambda is a reserved word in Python. Use aws_lambda as lambda_, as the converter does.
• Passing plain numbers for durations. Props like visibility_timeout and timeout expect Duration.seconds(60), not 60.
• Shadowing id. Name the constructor argument construct_id, as cdk init does, so it doesn't hide Python's built-in id().
• Forgetting the virtual environment. Running cdk synth outside the activated .venv picks up a different or missing aws-cdk-lib and fails with import errors.
• Releasing Terraform state first. If you run terraform state rm before cdk import succeeds, nothing manages the resource for a while. Adopt it in CDK first, then release it from Terraform.

Frequently asked questions

Related tools and next steps

• CDK TypeScript to Python converterPort existing CDK TypeScript stacks to the same Python style.
• Terraform to CDK TypeScript converterThe same conversion for TypeScript projects.
• AWS CDK to Terraform converterTurn a CDK stack back into explicit Terraform resources.
• IAM policy from Python codeWrite a least-privilege policy for the boto3 code your functions run.
• All AWS code convertersEvery SDK, infrastructure-as-code and IAM tool in one place.
• ChatWithCloud use casesSee what you can ask your AWS account once the stack is deployed.