fm terraform

Reference for the fm terraform command group (auto-generated from fm terraform --help).

fm terraform

Work with Terraform against the Frostmoln platform.

Subcommands:
  convert   Convert a Terraform configuration written for AWS, Azure, GCP,
            or Oracle Cloud into the equivalent Frostmoln provider config.

Usage:
  fm terraform [command]

Available Commands:
  convert     Convert Terraform configuration to the Frostmoln provider

Flags:
  -h, --help   help for terraform

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm terraform [command] --help" for more information about a command.

fm terraform convert

Convert a Terraform configuration written for AWS, Azure, GCP, or Oracle
Cloud into the equivalent configuration using the Frostmoln provider.

The converter preserves your file and module layout, rewrites what maps
cleanly, and reports every resource or attribute Frostmoln does not support
yet. Unsupported items are commented out in place and flagged with grep-able
FM-CONVERT markers; where a live catalog value is needed but unavailable
(flavors, regions, images), a FM-TODO placeholder data source is emitted for
you to complete.

The output holds your Terraform (.tf, .tf.json, .tfvars, .tfvars.json) plus
any file your configuration reads with file() or templatefile() at a literal
path — a user_data script, a cloud-init template, an SSH public key. A path
built from a variable cannot be followed, so that file is not copied. Nothing
else is, and skipped files are listed in the report.

Point it at the REPOSITORY ROOT, not at a single environment directory: every
directory holding .tf files is converted, and module sources such as
"../modules/net" only resolve when the shared modules live inside the tree
being converted.

By default the command runs FULLY OFFLINE — no account and no network are
required, and no catalog is consulted, so flavor/image lookups become
FM-TODO placeholders you fill in (or re-run with --online). Pass --online to
resolve real catalog values through the authenticated Frostmoln gateway;
that path requires 'fm auth login' (or an API key) and is subject to the
minimum-CLI-version check. If a catalog endpoint is unreachable or errors,
--online degrades to the offline FM-TODO placeholders and prints a warning
rather than failing. Everything BEFORE that fetch is an error instead —
authentication, the CLI version check, and determining the tenant: the run
never established whose catalogue to read.

--online resolves against ONE tenant: the selected one — --tenant, then
FM_TENANT, then 'fm tenant use', then your default tenant. Flavors and
regions are platform-wide and identical for everyone, but IMAGES are that
tenant's view (the public catalogue plus that tenant's own private images),
so converting for a different tenant than you deploy to can resolve an image
that tenant cannot see. The tenant is named as the run starts: on the
progress line under table/wide output, on stderr under -o json/-o yaml so it
stays out of the report document, and not at all under -q — the report itself
records the catalog source and endpoint, not the tenant. Pass --tenant <id>
to name the tenant outright and skip the profile lookup; that flag is for a
profile lookup you cannot make, not for an expired session, which needs
'fm auth login'.

State migration is out of scope: this converts configuration only. Review
the findings and the FM-TODO/FM-CONVERT markers before running terraform.

A block the converter cannot translate is commented out with the reason
above it. Read those: where Frostmoln does the same thing a different way,
the comment names the resource to write instead — so a blocker is usually a
pointer, not a dead end. "No conversion mapping for type" means the opposite:
the converter has nothing to say about that type at all.

Some resource ADDRESSES move. Where a cloud has one resource type per
variant and Frostmoln has one — Azure declares a separate type per DNS
record instanceType, so A, TXT and MX records for the same host share a name label
that collapses onto a single Frostmoln address — the converter appends the
distinguishing part of the source type (root becomes root_a, root_txt,
root_mx). Every move is reported as a warning, and the JSON report carries
the new address in the finding's targetAddress field: imports and existing
state entries for those resources need 'terraform state mv'.

The output directory and everything in it are created readable by you only:
the converted tree copies your variable files, and those routinely hold
credentials. Check the permissions again if you move or share it.

Exit codes:
  0  converted cleanly (info/warning findings are still exit 0)
  2  converted, but blocker findings exist (output is still written)
  1  usage, I/O, API, or authentication error (nothing usable written)

Usage:
  fm terraform convert <dir> [flags]

Examples:
  # Offline conversion of a whole repository into ./infra/frostmoln
  fm terraform convert ./infra

  # Force a specific source provider and output directory
  fm terraform convert ./infra --provider aws --out ./converted

  # Resolve live catalog values and save the JSON report
  fm terraform convert ./infra --online --report report.json

Flags:
      --force             overwrite a non-empty output directory
  -h, --help              help for convert
      --online            resolve live catalog values via the authenticated gateway (requires auth; version-gated)
      --out string        output directory (default: <dir>/frostmoln)
      --provider string   source cloud provider: auto|aws|azure|gcp|oci (auto autodetects) (default "auto")
      --report string     write the full findings report as JSON to this file

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)