Migration
CDKTF was archived. Your infrastructure doesn't have to be.
HashiCorp sunset CDKTF on December 10, 2025. The good news: it always synthesized Terraform, so your resources and state already live in the Terraform ecosystem. The migration is mostly converting generated configuration into HCL your team can maintain.
What actually changed
Three facts shape every migration decision. The rest is execution.
Archived, not deleted
On December 10, 2025 HashiCorp archived CDKTF and stopped maintaining it. The code is still on GitHub, but there are no fixes or provider compatibility updates.
Terraform was always underneath
CDKTF synthesized Terraform configuration and ran it with Terraform. Your resources and state already belong to the Terraform ecosystem.
HashiCorp documented the exit
The sunset notice points to cdktf synth --hcl, which generates readable HCL from your project. That output is the starting point for a standard workflow.
The migration path
HashiCorp's own advice was to migrate to HCL. This is the sequence we see work, whether you finish in a weekend or move one stack at a time.
1. Generate HCL from your project
Run the supported conversion while your toolchain still works. Keep the output in version control so every later change is reviewable.
cdktf synth --hcl # Review what was generated before doing anything else ls cdktf.out/stacks/
2. Point Terraform at your existing state
Keep the same backend you used with CDKTF, or copy the state to the backend you want to use going forward. Then initialize and plan.
terraform init terraform plan # If addresses differ, reconcile them instead of recreating: # terraform state mv <old-address> <new-address>
3. Organize the output
Generated HCL is flat. Group it by purpose, extract environment-specific values into variables, and remove drift you no longer want to manage.
units/
acme/
network/ # VPC, subnets, routing
data/ # RDS, S3, backups
app/ # compute, queues, CDN
inventory/
acme/
dev.json
prod.json4. Review, then apply
Treat the first plan as a migration test. An empty plan means the conversion is faithful. Anything else is a decision you should make deliberately.
terraform plan -out=migration.tfplan # Apply only after the diff matches your intent terraform apply migration.tfplan
Before and after
A small stack, converted. The resources are the same; the second version is the one your team can read, review, and hand to any Terraform tool.
CDKTF (TypeScript)
class AssetsStack extends TerraformStack {
constructor(scope: Construct, id: string) {
super(scope, id);
new AwsProvider(this, 'aws', {
region: 'eu-central-1',
});
const bucket = new S3Bucket(this, 'assets', {
bucket: 'acme-assets-prod',
});
new S3BucketVersioningA(this, 'assets-versioning', {
bucket: bucket.id,
versioningConfiguration: { status: 'Enabled' },
});
}
}Standard HCL
provider "aws" {
region = "eu-central-1"
}
resource "aws_s3_bucket" "assets" {
bucket = "acme-assets-prod"
}
resource "aws_s3_bucket_versioning" "assets" {
bucket = aws_s3_bucket.assets.id
versioning_configuration {
status = "Enabled"
}
}Where IaCConsole fits
We do not rewrite your CDKTF code for you. The conversion is HashiCorp's cdktf synth --hcl. Our job starts after it.
- Agents read the generated HCL, explain what each resource does, and propose module boundaries before you split a flat stack by hand.
- DevSecOps and FinOps review the plan for security and cost issues while it is still a diff, not after it is applied.
- Secure Agent Mode runs Terraform in your environment, so the cloud credentials you already have do not need to move.
- The output stays standard HCL. Export it and run it anywhere, with or without us.
Start with one stack
Do not migrate everything at once. Pick a stack with low blast radius, convert it, and confirm that terraform plan is empty against existing state. That single result tells you more than any migration plan document.
If your CDKTF project is tightly integrated with AWS CDK, HashiCorp suggested evaluating AWS CDK directly. If it is plain CDKTF, standard HCL is the lower-risk path.
Frequently asked questions
What teams ask before moving off CDKTF.
Is CDKTF still usable after the archive?
Yes, the code remains available on GitHub under the MPL license and you can keep using it. But the repository is read-only: HashiCorp no longer ships fixes, security patches, or compatibility updates for new Terraform and provider versions. That is why most teams plan a move now rather than later.
What does cdktf synth --hcl actually produce?
It generates readable HCL configuration from your CDKTF project instead of the JSON Terraform normally receives. HashiCorp documented it as the migration path before archiving the project. The output is a starting point: review naming, module boundaries, and variables before you apply it.
Do I have to rewrite my infrastructure from scratch?
No. CDKTF synthesized configuration and ran it through Terraform, so your resources and state are already Terraform resources and state. The work is converting the synthesized configuration into maintainable HCL, and reconciling resource addresses where the generated names differ from your old construct paths.
Will my existing state still work?
Terraform state is not CDKTF-specific. Point the generated configuration at the same backend, run terraform init, and compare with terraform plan. If the plan wants to replace resources because their state addresses changed, reconcile with terraform state mv before applying anything.
Does IaCConsole convert my CDKTF app automatically?
No. The supported conversion is HashiCorp's cdktf synth --hcl. We help with the part after that: reviewing the generated HCL, organizing it into units, and running plans with security and cost review in your own cloud account.
How long does a CDKTF migration take?
It depends on how many stacks and resources you run. Start with one stack, confirm that terraform plan is empty against existing state, and move the rest stack by stack. Most of the effort is review and organization, not rewriting resources.
Bring one stack. Leave with a plan you can defend.
Install the free CLI, convert a single CDKTF stack, and review the first plan with the agents. No credit card and no sales call required.
CDKTF is a project of HashiCorp, an IBM company. IaCConsole is not affiliated with or endorsed by HashiCorp. Read the full migration guide.