How would you tackle AWS resources that never made it into Terraform?

I would treat this as an ownership and inventory problem first, and a Terraform import problem second. Enable a reliable account-wide inventory, then review resources by service and environment with the people responsible for the workloads. Record what each resource does, its owner, and whether it is still needed. Unknown does not automatically mean safe to delete.

After that, bring important resources into Terraform in manageable groups. Generated configuration can speed up the first pass, but check provider coverage and review the result before applying anything. Some resources will need hand-written configuration or may not be worth importing. Keep a separate list of gaps so that partial coverage is visible rather than mistaken for recoverability.

Start tagging resources created by Terraform with a consistent marker, such as the owning repository or team. Then you can compare tagged resources with the wider inventory and get a useful list of things that need investigation. It will not catch every resource, since tagging support varies, and tags can be missing or stale, so treat it as a filter rather than proof.

For the backlog, pick a service or workload at a time. Confirm what is in use, then import the pieces that belong in Terraform and document anything intentionally left outside it. A small, maintained exception list beats a giant mystery pile.

Resource generators are useful for a one-time backfill, but they are not a magic conversion button. They only cover supported resource types, and generated configuration may not reflect how your team wants to manage the resource. I would use one to reduce typing, then review each result and import deliberately.

For resources you can identify but the generator misses, Terraform's import workflow can still help connect configuration to existing infrastructure. Be cautious with plans: importing should not be followed by a surprise replacement or modification. Test in a controlled environment and review the plan carefully before applying.

If the current setup makes ownership impossible to establish, consider using a clean account or environment for new work, with permissions that require deployments through the approved Terraform path. That will not fix the legacy accounts, but it can stop the unmanaged portion from growing while you work through it.

For the existing estate, an inventory and a recovery exercise are more useful than assuming Terraform coverage equals recovery coverage. Identify dependencies and test rebuilding a representative workload. Repeat as coverage improves.