Import state verification in Terraform - Commands & Configuration

Introduction

Sometimes you create resources outside Terraform and want Terraform to manage them. Importing lets Terraform track these resources. Import state verification checks that Terraform knows about the resource correctly.

When you have a cloud server created manually and want Terraform to manage it.

When you moved resources from one Terraform project to another and need to sync state.

When you want to avoid recreating existing resources by importing them into Terraform.

When you want to confirm Terraform's state matches the real resource after import.

When you want to fix Terraform state after manual changes outside Terraform.

Config File - main.tf

main.tf

provider "aws" {
  region = "us-east-1"
}

resource "aws_instance" "example" {
  # The instance will be imported, so no need to set all attributes here
  # Just define the resource block with the correct name
}

This file sets the AWS provider region and declares an AWS EC2 instance resource named "example". The resource block is empty because the instance already exists and will be imported. Terraform needs this block to link the imported resource to the configuration.

Commands

Initializes Terraform in the current directory to download providers and prepare the working directory.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding latest version of hashicorp/aws...

- Installing hashicorp/aws v4.0.0...

- Installed hashicorp/aws v4.0.0 (signed by HashiCorp)



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see any changes.

Imports the existing AWS EC2 instance with ID i-0abcd1234efgh5678 into Terraform state under the resource name aws_instance.example.

Terminal

terraform import aws_instance.example i-0abcd1234efgh5678

Expected Output

aws_instance.example: Importing from ID "i-0abcd1234efgh5678"...

aws_instance.example: Import prepared!

  Prepared aws_instance for import

aws_instance.example: Refreshing state... [id=i-0abcd1234efgh5678]



Import successful!



The resources that were imported are now in your Terraform state and will be managed by Terraform.

Shows the difference between the current Terraform state and the configuration to verify the import was successful and no changes are pending.

Terminal

terraform plan

Expected Output

Refreshing Terraform state in-memory prior to plan...



No changes. Infrastructure is up-to-date.



This means that Terraform did not detect any differences between your configuration and real physical resources that exist.

Key Concept

If you remember nothing else from this pattern, remember: terraform import links existing resources to Terraform state so Terraform can manage them.

Common Mistakes

Running terraform import without defining the resource block in the configuration file.

Terraform needs the resource block to know how to manage the imported resource; without it, import fails or state is incomplete.

Always declare the resource block with the correct resource type and name before running terraform import.

Using the wrong resource ID when running terraform import.

Terraform cannot find the resource to import, causing an error or importing the wrong resource.

Verify the exact resource ID from your cloud provider before importing.

Not running terraform plan after import to verify the state.

You might miss configuration mismatches or pending changes that could cause resource replacement or errors later.

Always run terraform plan after import to confirm the state matches the configuration.

Summary

Initialize Terraform with terraform init to prepare the working directory.

Declare the resource block in main.tf matching the resource you want to import.

Run terraform import with the correct resource ID to link the existing resource to Terraform state.

Run terraform plan to verify Terraform state matches the real resource and no changes are pending.

Practice

1. What is the main purpose of terraform import in Terraform?

easy

A. To create new resources in the cloud

B. To update Terraform version

C. To delete resources from the cloud

D. To bring existing cloud resources into Terraform state management

Solution

1. Step 1: Understand Terraform state

   Terraform state tracks resources it manages. Existing resources outside Terraform are unknown to it.

2. Step 2: Role of terraform import

   The terraform import command adds existing resources to Terraform state without creating or deleting them.

3. Final Answer:

   To bring existing cloud resources into Terraform state management -> Option D

4. Quick Check:

   Import = Add existing resource to state [OK]

Hint: Import links existing resources to Terraform state [OK]

Common Mistakes:

• Thinking import creates new resources
• Confusing import with terraform apply
• Assuming import deletes resources

2. Which of the following is the correct syntax to import an AWS EC2 instance with ID i-1234567890abcdef0 into Terraform resource aws_instance.example?

easy

A. terraform import aws_instance i-1234567890abcdef0.example

B. terraform import aws_instance.example i-1234567890abcdef0

C. terraform import i-1234567890abcdef0 aws_instance.example

D. terraform import example.aws_instance i-1234567890abcdef0

Solution

1. Step 1: Identify correct command order

   The syntax is terraform import <resource_address> <resource_id>.

2. Step 2: Match resource address and ID

   Resource address is aws_instance.example, ID is i-1234567890abcdef0. So terraform import aws_instance.example i-1234567890abcdef0 matches syntax correctly.

3. Final Answer:

   terraform import aws_instance.example i-1234567890abcdef0 -> Option B

4. Quick Check:

   Import syntax = terraform import resource_address resource_id [OK]

Hint: Resource address first, then resource ID in import command [OK]

Common Mistakes:

• Swapping resource address and ID
• Using dot in wrong place
• Missing resource type or name

3. After running terraform import aws_s3_bucket.mybucket my-bucket-name, what will terraform plan show if the Terraform configuration matches the imported bucket exactly?

medium

A. Plan to delete the imported bucket.

B. Plan to create a new S3 bucket.

C. No changes. Terraform state matches configuration.

D. Error: Resource not found.

Solution

1. Step 1: Understand import effect

   Import adds existing resource to state but does not change configuration files.

2. Step 2: Compare state and config

   If configuration matches the imported resource exactly, terraform plan shows no changes needed.

3. Final Answer:

   No changes. Terraform state matches configuration. -> Option C

4. Quick Check:

   Matching config and state = no changes [OK]

Hint: Plan shows no changes if config matches imported state [OK]

Common Mistakes:

• Expecting terraform plan to create or delete after import
• Confusing import with apply
• Ignoring configuration mismatch

4. You ran terraform import aws_db_instance.db1 db-1234 but terraform plan shows the instance will be destroyed and recreated. What is the most likely cause?

medium

A. The Terraform configuration does not match the imported resource attributes

B. The import command was run with wrong resource ID

C. Terraform state file is corrupted

D. Terraform version is outdated

Solution

1. Step 1: Analyze import and plan mismatch

   If plan wants to destroy and recreate, it means config differs from imported resource state.

2. Step 2: Confirm configuration matches resource

   Mismatch in attributes causes Terraform to think resource needs replacement.

3. Final Answer:

   The Terraform configuration does not match the imported resource attributes -> Option A

4. Quick Check:

   Config mismatch causes resource replacement plan [OK]

Hint: Mismatch between config and imported resource causes replacement plan [OK]

Common Mistakes:

• Assuming import ID error always causes plan changes
• Blaming Terraform version without checking config
• Ignoring attribute differences

5. You want to import multiple existing AWS security groups into Terraform. Which approach ensures correct import and verification?

hard

A. Run terraform import for each security group, then run terraform plan to verify state matches configuration

B. Run terraform apply directly to create new security groups

C. Delete existing security groups and recreate with Terraform

D. Edit the Terraform state file manually to add security groups

Solution

1. Step 1: Import each existing security group

   Use terraform import with correct resource address and IDs for each group.

2. Step 2: Verify with terraform plan

   Run terraform plan to check if imported state matches configuration and no unexpected changes occur.

3. Final Answer:

   Run terraform import for each security group, then run terraform plan to verify state matches configuration -> Option A

4. Quick Check:

   Import each resource, then verify with plan [OK]

Hint: Import individually and verify with plan to avoid surprises [OK]

Common Mistakes:

• Skipping plan after import
• Trying to create duplicates with apply
• Manually editing state file causing errors