Import #

# AWS: How to find resource IDs

# EC2 Instance — use the instance ID
aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId'
# Output: ["i-0abcdef1234567890"]

# VPC — use the VPC ID
aws ec2 describe-vpcs --query 'Vpcs[].VpcId'
# Output: ["vpc-0abcdef1234567890"]

# S3 Bucket — use the bucket name
aws s3api list-buckets --query 'Buckets[].Name'
# Output: ["my-existing-bucket"]

# RDS Instance — use the DB identifier
aws rds describe-db-instances --query 'DBInstances[].DBInstanceIdentifier'
# Output: ["production-database"]

# Security Group — use the security group ID
aws ec2 describe-security-groups --query 'SecurityGroups[].GroupId'
# Output: ["sg-0abcdef1234567890"]

# Format: terraform import <resource_address> <resource_id>

# Step 1: Write an empty resource block (or one with configuration)
# main.tf:
resource "aws_instance" "web" {
  # Fill this in after importing
}

# Step 2: Import
terraform import aws_instance.web i-0abcdef1234567890

# Output:
# aws_instance.web: Importing from ID "i-0abcdef1234567890"...
# aws_instance.web: Import prepared!
#   Prepared aws_instance for import
# aws_instance.web: Refreshing state... [id=i-0abcdef1234567890]
#
# Import successful!

# Step 3: View all attributes stored in state
terraform state show aws_instance.web

# Step 4: Complete the configuration based on the state show output
resource "aws_instance" "web" {
  ami                    = "ami-0abcdef1234567890"
  instance_type          = "t3.micro"
  subnet_id              = "subnet-0abcdef1234"
  vpc_security_group_ids = ["sg-0abcdef1234567890"]

  tags = {
    Name        = "web-server"
    Environment = "production"
  }
}

# Step 5: Verify
terraform plan
# Expected result: "No changes. Your infrastructure matches the configuration."

# import.tf — a dedicated file for defining imports
import {
  to = aws_instance.web
  id = "i-0abcdef1234567890"
}

import {
  to = aws_vpc.main
  id = "vpc-0abcdef1234567890"
}

import {
  to = aws_security_group.web
  id = "sg-0abcdef1234567890"
}

# Generate configuration automatically based on the actual cloud condition
terraform plan -generate-config-out=generated_resources.tf

# Output: the generated_resources.tf file contains generated configuration
# Review this file — some attributes may need adjusting

# Apply the import
terraform apply

# When done, remove the import blocks (no longer needed)
# and move the configuration from generated_resources.tf into the right files

# Strategy 1: Bash script for bulk imports
#!/bin/bash

# Get all instance IDs
INSTANCES=$(aws ec2 describe-instances \
  --filters "Name=tag:ManagedBy,Values=manual" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text)

# Import each instance
for INSTANCE_ID in $INSTANCES; do
  # Create the resource name from the Name tag
  NAME=$(aws ec2 describe-instances \
    --instance-ids $INSTANCE_ID \
    --query 'Reservations[0].Instances[0].Tags[?Key==`Name`].Value' \
    --output text | tr '[:upper:]' '[:lower:]' | tr ' ' '_')

  echo "Importing $NAME ($INSTANCE_ID)..."
  terraform import "aws_instance.$NAME" "$INSTANCE_ID"
done

# Strategy 2: for_each in import blocks (Terraform 1.7+)
locals {
  instances = {
    web_1    = "i-0abcdef1234567890"
    web_2    = "i-0abcdef2345678901"
    worker_1 = "i-0abcdef3456789012"
  }
}

import {
  for_each = local.instances
  to       = aws_instance.servers[each.key]
  id       = each.value
}

resource "aws_instance" "servers" {
  for_each      = local.instances
  ami           = var.ami_id
  instance_type = "t3.micro"
}

# PITFALL 1: Configuration doesn't match the actual condition
# After importing, terraform plan shows changes
# → the .tf configuration differs from the actual condition
#
# terraform plan output:
# ~ resource "aws_instance" "web" {
#     ~ instance_type = "t3.micro" -> "t3.small"
#   }
#
# This means the actual instance is t3.small, not t3.micro as you wrote
# Adjust the .tf configuration to match the actual condition

# PITFALL 2: Importing resources with computed attributes
# Some attributes can only be known after the resource exists
# Don't write values that can change or aren't deterministic in the config

# PITFALL 3: Importing resources that already have dependencies
# If the VPC is imported but the subnets aren't, the dependency graph is incomplete
# Always import starting from "foundation" resources (VPC, IAM roles, etc.)
# before the resources that depend on them

# PITFALL 4: Forgetting to remove import blocks when done
# Leftover import blocks don't cause errors,
# but waste time on every plan because Terraform tries to re-import

# Batch import script for EC2 instances
INSTANCES=$(aws ec2 describe-instances \
  --filters "Name=tag:ManagedBy,Values=manual" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text)

for INSTANCE_ID in $INSTANCES; do
  NAME=$(aws ec2 describe-instances \
    --instance-ids $INSTANCE_ID \
    --query 'Reservations[].Instances[].Tags[?Key==`Name`].Value' \
    --output text)
  
  RESOURCE_NAME="web_server_$(echo $NAME | tr '-' '_')"
  
  echo "Importing $INSTANCE_ID as aws_instance.$RESOURCE_NAME"
  terraform import "aws_instance.$RESOURCE_NAME" "$INSTANCE_ID"
done

# Define the resource with for_each
resource "aws_security_group_rule" "ingress" {
  for_each = var.security_group_rules

  type              = "ingress"
  from_port         = each.value.from_port
  to_port           = each.value.to_port
  protocol          = each.value.protocol
  cidr_blocks       = each.value.cidr_blocks
  security_group_id = aws_security_group.main.id
}

# Import one by one
terraform import 'aws_security_group_rule.ingress["http"]'   sg-12345_ingress_tcp_80_80_0.0.0.0/0

terraform import 'aws_security_group_rule.ingress["https"]'   sg-12345_ingress_tcp_443_443_0.0.0.0/0

# Helper script for bulk imports
#!/bin/bash
RULES=("http:80:80:tcp:0.0.0.0/0" "https:443:443:tcp:0.0.0.0/0")
SG_ID="sg-12345"

for RULE in "${RULES[@]}"; do
  IFS=':' read -r NAME FROM TO PROTO CIDR <<< "$RULE"
  IMPORT_ID="${SG_ID}_ingress_${PROTO}_${FROM}_${TO}_${CIDR}"
  echo "Importing aws_security_group_rule.ingress[\"$NAME\"]"
  terraform import "aws_security_group_rule.ingress[\"$NAME\"]" "$IMPORT_ID"
done

# Problem 1: "Cannot import non-existent remote object"
# Meaning: the resource isn't found in the cloud provider
# Solution: make sure the ID is correct, check the right region

# Problem 2: "Resource already managed by Terraform"
# Meaning: the resource is already in state
# Solution: remove it from state first, then import again
terraform state rm aws_instance.web
terraform import aws_instance.web i-12345

# Problem 3: "Import ID doesn't match the resource"
# Example: importing EC2 but the ID isn't an instance ID
# Check the provider documentation for the correct import ID format

# Problem 4: "Error: Cannot import to non-existent resource address"
# Meaning: the resource block doesn't exist in HCL yet
# Solution: write the resource block first, then run the import

# Import several resources at once (script)
#!/bin/bash
resources=(
  "aws_instance.web:i-12345"
  "aws_security_group.web:sg-67890"
  "aws_subnet.main:subnet-abcde"
)

for item in "${resources[@]}"; do
  IFS=":" read -r addr id <<< "$item"
  echo "Importing $addr with ID $id"
  terraform import "$addr" "$id"
done

# Import with Terraform Cloud
# Terraform Cloud supports imports via the UI
# Navigate to the workspace → Settings → Import
# Or use the API:
curl -X POST "https://app.terraform.io/api/v2/workspaces/$WS_ID/actions/import" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{"data":{"type":"imports","attributes":{"address":"aws_instance.web","id":"i-12345"}}}'