Skip to content
AITroveRead. Build. Understand.
Reading list
Make this comfortable

Terraform import: adopt one existing object under one state owner

Last updated: 5 Oct 20266 min read
tutorial
AdvancedBy AITrove Editorial

An import block maps an existing remote object to a Terraform resource address. It does not create a complete, correct configuration for that object, nor does it settle which team owns future edits. Once an object is represented in state, later plans can propose changes or destruction. Import succeeds only when the intended address, provider identity, remote identifier, configuration, and operational owner all refer to the same object.

Operational decision

A receipt archive bucket was created manually during an outage. First record its account, region, name, encryption, retention, access policy, replication, and current owner. Check every known state and automation path for an existing manager; importing the same bucket into two states creates competing writers. Write the resource configuration to match the approved live settings, then add the import mapping shown below. Run a plan in a controlled workspace and inspect the import action plus every subsequent update or replacement. A post-import plan proposing to relax retention is a configuration mismatch, not a harmless import detail. Test with a disposable bucket before touching the live one. After application, run a fresh plan and confirm no unexplained changes, then retire the manual change path so the next operator does not edit the bucket outside the new owner.

hcl
import {
  to = aws_s3_bucket.receipt_archive
  id = "receipt-archive-prod"
}

resource "aws_s3_bucket" "receipt_archive" {
  bucket = "receipt-archive-prod"
}

Cost and verification

Import reads remote attributes and writes state; the immediate API and storage cost is usually small compared with the risk of a later incorrect plan. Some resources require related policies, access rules, or subresources to be modeled separately, which expands review time. A single import can therefore create several follow-up ownership tasks. Measure unexplained drift after import, competing automation writes, and the count of objects whose live settings lack a declared owner. Do not use plan success as proof that the archive remains compliant.

Common Mistakes

  • Do not import one remote object into two active states.
  • Do not accept generated configuration without reviewing retention and security arguments.
  • Do not assume an import action proves the next plan is a no-op.

Connected lessons

Practice and check

devops
operations
Storage details