War Story: Migrating 1000+ IaC Modules from Terraform 1.10 to Pulumi 3.130 with Checkov 3.0

# terraform 1.10 required version constraint
terraform {
  required_version = ">= 1.10.0, < 2.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.30.0, < 6.0.0"
    }
    checkov = {
      source  = "bridgecrewio/checkov"
      version = ">= 3.0.0, < 4.0.0"
    }
  }
}

# configure aws provider with default tags
provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      ManagedBy = "terraform"
      Module    = "vpc-1.10"
      Repo      = var.repo_url
    }
  }
}

# variable definitions with validation
variable "aws_region" {
  type        = string
  description = "AWS region to deploy VPC into"
  default     = "us-east-1"

  validation {
    condition     = contains(["us-east-1", "us-west-2", "eu-west-1"], var.aws_region)
    error_message = "Unsupported AWS region. Allowed: us-east-1, us-west-2, eu-west-1."
  }
}

variable "vpc_cidr" {
  type        = string
  description = "CIDR block for the VPC"
  default     = "10.0.0.0/16"

  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0)) && split("/", var.vpc_cidr)[1] <= 24
    error_message = "VPC CIDR must be a valid IPv4 CIDR with prefix length <= 24."
  }
}

variable "repo_url" {
  type        = string
  description = "GitHub repository URL for the module"
  default     = "https://github.com/our-org/terraform-modules"
}

# vpc resource with checkov compliance tags
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name        = "prod-vpc-${var.aws_region}"
    CheckovStatus = "enabled"
  }
}

# public subnet
resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone       = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true

  tags = {
    Name = "prod-public-subnet-${count.index}"
  }
}

# data source for azs
data "aws_availability_zones" "available" {
  state = "available"
}

# internet gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "prod-igw"
  }
}

# route table for public subnets
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "prod-public-rt"
  }
}

# route table association
resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

# terraform 1.10 check block for compliance
check "vpc_cidr_compliance" {
  assert {
    condition     = aws_vpc.main.cidr_block == var.vpc_cidr
    error_message = "VPC CIDR does not match input variable."
  }
}

check "subnet_az_coverage" {
  assert {
    condition     = length(aws_subnet.public) == 2
    error_message = "Expected 2 public subnets, got ${length(aws_subnet.public)}."
  }
}

# outputs
output "vpc_id" {
  value       = aws_vpc.main.id
  description = "ID of the created VPC"
}

output "public_subnet_ids" {
  value       = aws_subnet.public[*].id
  description = "IDs of public subnets"
}

output "vpc_cidr" {
  value       = aws_vpc.main.cidr_block
  description = "CIDR block of the VPC"
}

# Terraform dynamic block example
dynamic "subnet" {
  for_each = var.subnet_cidrs
  content {
    cidr_block = subnet.value
    availability_zone = subnet.key
  }
}

// Pulumi equivalent using TypeScript map
const subnets = var.subnetCidrs.map((cidr, az) => 
  new aws.ec2.Subnet(`subnet-${az}`, { cidrBlock: cidr, availabilityZone: az })
);

// Pulumi 3.130 TypeScript VPC Module equivalent to Terraform 1.10 example
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import { CheckovRunner } from "@bridgecrew/checkov-pulumi"; // Checkov 3.0 Pulumi integration

// load stack config
const config = new pulumi.Config();
const awsRegion = config.get("awsRegion") || "us-east-1";
const vpcCidr = config.get("vpcCidr") || "10.0.0.0/16";
const repoUrl = config.get("repoUrl") || "https://github.com/our-org/pulumi-modules";

// validate inputs (error handling)
const allowedRegions = ["us-east-1", "us-west-2", "eu-west-1"];
if (!allowedRegions.includes(awsRegion)) {
  throw new pulumi.InputError(
    `Unsupported AWS region: ${awsRegion}. Allowed: ${allowedRegions.join(", ")}`
  );
}

// validate CIDR prefix
const cidrParts = vpcCidr.split("/");
if (cidrParts.length !== 2 || parseInt(cidrParts[1]) > 24) {
  throw new pulumi.InputError(
    `VPC CIDR must be valid IPv4 with prefix length <= 24. Got: ${vpcCidr}`
  );
}

// configure AWS provider with default tags
const awsProvider = new aws.Provider("aws-provider", {
  region: awsRegion,
  defaultTags: {
    tags: {
      ManagedBy: "pulumi",
      Module: "vpc-3.130",
      Repo: repoUrl,
    },
  },
});

// create VPC
const vpc = new aws.ec2.Vpc("prod-vpc", {
  cidrBlock: vpcCidr,
  enableDnsSupport: true,
  enableDnsHostnames: true,
  tags: {
    Name: `prod-vpc-${awsRegion}`,
    CheckovStatus: "enabled",
  },
}, { provider: awsProvider });

// get available AZs
const availableAzs = aws.getAvailabilityZones({
  state: "available",
}, { provider: awsProvider }).then(zones => zones.names.slice(0, 2));

// create public subnets
const publicSubnets = pulumi.all([availableAzs]).apply(([azs]) => {
  return azs.map((az, index) => {
    const subnetCidr = aws.ec2.Vpc.prototype.cidrBlock.apply(cidr => 
      aws.ec2.getSubnetCidrBlock({ ipv4CidrBlock: cidr, newBits: 8, netnum: index })
    );
    return new aws.ec2.Subnet(`prod-public-subnet-${index}`, {
      vpcId: vpc.id,
      cidrBlock: subnetCidr.then(c => c.cidrBlock),
      availabilityZone: az,
      mapPublicIpOnLaunch: true,
      tags: { Name: `prod-public-subnet-${index}` },
    }, { provider: awsProvider });
  });
});

// create internet gateway
const igw = new aws.ec2.InternetGateway("prod-igw", {
  vpcId: vpc.id,
  tags: { Name: "prod-igw" },
}, { provider: awsProvider });

// create public route table
const publicRouteTable = new aws.ec2.RouteTable("prod-public-rt", {
  vpcId: vpc.id,
  routes: [{
    cidrBlock: "0.0.0.0/0",
    gatewayId: igw.id,
  }],
  tags: { Name: "prod-public-rt" },
}, { provider: awsProvider });

// associate route table with subnets
const routeTableAssociations = pulumi.all([publicSubnets]).apply(([subnets]) => {
  return subnets.map((subnet, index) => {
    return new aws.ec2.RouteTableAssociation(`prod-rta-${index}`, {
      subnetId: subnet.id,
      routeTableId: publicRouteTable.id,
    }, { provider: awsProvider });
  });
});

// initialize Checkov 3.0 runner for compliance checks
const checkov = new CheckovRunner({
  framework: "pulumi",
  policyPacks: ["aws-best-practices"], // custom Checkov 3.0 policy pack
  softFail: false, // fail deployment on policy violations
});

// run Checkov pre-deploy (Pulumi 3.130 preview hook)
pulumi.previewHooks.push(async () => {
  const results = await checkov.run({
    resources: [vpc, ...publicSubnets, igw, publicRouteTable],
  });
  if (results.failed.length > 0) {
    throw new Error(
      `Checkov 3.0 found ${results.failed.length} policy violations: ${JSON.stringify(results.failed)}`
    );
  }
});

// Pulumi 3.130 invariant checks (equivalent to Terraform check blocks)
pulumi.invariant(vpc.cidrBlock.apply(cidr => cidr === vpcCidr), {
  message: "VPC CIDR does not match input variable",
});

pulumi.invariant(publicSubnets.apply(subnets => subnets.length === 2), {
  message: "Expected 2 public subnets, got ${publicSubnets.apply(s => s.length)}",
});

// exports (equivalent to Terraform outputs)
export const vpcId = vpc.id;
export const publicSubnetIds = publicSubnets.apply(subnets => subnets.map(s => s.id));
export const vpcCidrBlock = vpc.cidrBlock;

// Migration script: Terraform 1.10 HCL to Pulumi 3.130 TypeScript
// Requires: @pulumi/pulumi, @hashicorp/hcl2json, fs-extra, glob
import * as fs from "fs-extra";
import * as glob from "glob";
import * as hcl2json from "@hashicorp/hcl2json";
import * as pulumi from "@pulumi/pulumi";
import * as path from "path";

// configuration
const TF_MODULES_GLOB = "./terraform-modules/**/*.tf"; // path to Terraform 1.10 modules
const PULUMI_OUTPUT_DIR = "./pulumi-modules"; // output directory for Pulumi modules
const CHECKOV_POLICY_PACK = "aws-best-practices"; // Checkov 3.0 policy pack to embed

// interface for parsed Terraform module
interface TerraformModule {
  terraformVersion: string;
  resources: Array<{
    type: string;
    name: string;
    attributes: Record;
  }>;
  variables: Record;
  outputs: Record;
}

// parse Terraform HCL to JSON (error handling included)
async function parseTerraformModule(tfFilePath: string): Promise {
  try {
    const tfContent = await fs.readFile(tfFilePath, "utf-8");
    const json = hcl2json.parse(tfContent); // parse HCL to JSON

    // validate Terraform version
    const tfVersion = json.terraform?.[0]?.required_version || ">= 1.10.0";
    if (!tfVersion.includes("1.10")) {
      throw new Error(`Module ${tfFilePath} uses unsupported Terraform version: ${tfVersion}`);
    }

    // extract resources, variables, outputs
    const resources = Object.entries(json)
      .filter(([key]) => key.startsWith("resource"))
      .flatMap(([_, value]) => {
        const resArr = value as Array>;
        return resArr.flatMap(res => 
          Object.entries(res).map(([type, instances]) => ({
            type,
            name: Object.keys(instances)[0],
            attributes: instances[Object.keys(instances)[0]],
          }))
        );
      });

    const variables = json.variable?.[0] || {};
    const outputs = json.output?.[0] || {};

    return { terraformVersion: tfVersion, resources, variables, outputs };
  } catch (err) {
    throw new Error(`Failed to parse Terraform module ${tfFilePath}: ${err.message}`);
  }
}

// convert Terraform resource to Pulumi TypeScript code
function convertResourceToPulumi(resource: TerraformModule["resources"][0]): string {
  const { type, name, attributes } = resource;
  const pulumiType = type.replace("_", "."); // e.g., aws_vpc -> aws.ec2.Vpc

  // handle common attributes
  const attrLines = Object.entries(attributes)
    .filter(([key]) => !key.startsWith("tags")) // tags handled separately
    .map(([key, value]) => `  ${key}: ${JSON.stringify(value)},`)
    .join("
");

  const tagLines = attributes.tags 
    ? `  tags: ${JSON.stringify(attributes.tags, null, 2)},`
    : "";

  return `
// Converted from Terraform resource ${type}.${name}
const ${name} = new ${pulumiType}("${name}", {
${attrLines}
${tagLines}
});
`;
}

// main migration function
async function migrateModules() {
  try {
    // find all Terraform module files
    const tfFiles = glob.sync(TF_MODULES_GLOB);
    console.log(`Found ${tfFiles.length} Terraform 1.10 module files to migrate`);

    // create output directory
    await fs.ensureDir(PULUMI_OUTPUT_DIR);

    for (const tfFile of tfFiles) {
      const moduleName = path.basename(path.dirname(tfFile));
      console.log(`Migrating module: ${moduleName}`);

      // parse Terraform module
      const tfModule = await parseTerraformModule(tfFile);

      // generate Pulumi TypeScript code
      const pulumiCodeLines = [
        `// Pulumi 3.130 module converted from Terraform 1.10 module: ${moduleName}`,
        `import * as pulumi from "@pulumi/pulumi";`,
        `import * as aws from "@pulumi/aws";`,
        `import { CheckovRunner } from "@bridgecrew/checkov-pulumi";`,
        `` ,
        `const config = new pulumi.Config();`,
        `const checkov = new CheckovRunner({ framework: "pulumi", policyPacks: ["${CHECKOV_POLICY_PACK}"] });`,
        `` ,
        // add variables
        ...Object.entries(tfModule.variables).map(([name, def]) => 
          `const ${name} = config.get("${name}") || ${JSON.stringify(def.default)};`
        ),
        `` ,
        // add resources
        ...tfModule.resources.map(res => convertResourceToPulumi(res)),
        `` ,
        // add outputs
        `// Exports (Terraform outputs)`,
        ...Object.entries(tfModule.outputs).map(([name, def]) => 
          `export const ${name} = ${def.value.replace("aws_vpc.main.id", "vpc.id")};` // simple replacement for demo
        ),
      ];

      // write Pulumi module file
      const outputPath = path.join(PULUMI_OUTPUT_DIR, moduleName, "index.ts");
      await fs.ensureDir(path.dirname(outputPath));
      await fs.writeFile(outputPath, pulumiCodeLines.join("
"), "utf-8");

      console.log(`Wrote Pulumi module to ${outputPath}`);
    }

    console.log("Migration complete. Total modules migrated:", tfFiles.length);
  } catch (err) {
    console.error("Migration failed:", err.message);
    process.exit(1);
  }
}

// run migration
migrateModules();

// Add to your Pulumi index.ts
pulumi.previewHooks.push(async () => {
  const checkov = new CheckovRunner({ 
    framework: "pulumi", 
    policyPacks: ["aws-pci-dss", "our-internal-policies"],
    softFail: false 
  });
  const results = await checkov.run({ resources: allResources });
  if (results.failed.length > 0) {
    throw new Error(`Compliance violations: ${JSON.stringify(results.failed)}`);
  }
});

// Pulumi 3.130 invariant check equivalent to Terraform check block
pulumi.invariant(
  vpc.cidrBlock.apply(cidr => cidr === vpcCidr),
  { message: `VPC CIDR ${vpcCidr} does not match deployed CIDR ${vpc.cidrBlock}` }
);

pulumi.invariant(
  publicSubnets.apply(subnets => subnets.length === 2),
  { message: `Expected 2 public subnets, got ${publicSubnets.apply(s => s.length)}` }
);

// Parse Terraform HCL to JSON for automated conversion
import * as hcl2json from "@hashicorp/hcl2json";
const tfJson = hcl2json.parse(fs.readFileSync("main.tf", "utf-8"));
// Convert JSON to Pulumi TypeScript
const pulumiCode = convertTfJsonToPulumi(tfJson);