Import state verification in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens after importing a resource state in Terraform?

You run terraform import aws_instance.example i-1234567890abcdef0 to import an existing AWS EC2 instance into your Terraform state. What is the immediate effect on your Terraform state and configuration?

A The resource is added to the state file but must be defined in the configuration before applying changes.

B The resource is deleted from AWS and replaced by Terraform-managed resource.

C The resource is added to the configuration but not to the state file until you run <code>terraform apply</code>.

D The resource is added to both the state file and the configuration automatically.

💡 Hint

Think about what terraform import does versus what Terraform configuration files do.

Importing a resource adds it to the Terraform state file, but the resource must already be declared in the configuration files to be managed properly. Terraform does not modify configuration files automatically.

🧠 Conceptual

intermediate

Why verify Terraform state after import?

After importing a resource into Terraform state, why is it important to verify the state matches the actual resource?

A Because the import command deletes the resource if state is not verified.

B Because Terraform automatically fixes any mismatches during import.

C Because verifying state is optional and has no impact on Terraform behavior.

D Because mismatches can cause Terraform to attempt to recreate or destroy the resource on next apply.

💡 Hint

Consider what happens if Terraform's state does not reflect reality.

If the state does not match the actual resource, Terraform may try to change or replace the resource during the next apply, causing unintended disruptions.

❓ Configuration

advanced

Identify the Terraform import command for a GCP Compute Instance

You have a Google Cloud Compute Instance named my-instance in project my-project and zone us-central1-a. Which import command correctly imports this instance into Terraform resource google_compute_instance.vm?

A terraform import google_compute_instance.vm my-project/us-central1-a/my-instance

B terraform import google_compute_instance.vm projects/my-project/zones/us-central1-a/instances/my-instance

C terraform import google_compute_instance.vm my-instance

D terraform import google_compute_instance.vm zones/us-central1-a/projects/my-project/instances/my-instance

💡 Hint

Check the required resource ID format for GCP Compute Instances in Terraform import.

The correct format for importing a GCP Compute Instance includes the full resource path: projects/{project}/zones/{zone}/instances/{instance}.

❓ security

advanced

Security risk when importing Terraform state from external resources

What is a potential security risk when importing resources into Terraform state from external cloud accounts or projects?

A Importing resources disables cloud provider security groups temporarily.

B Terraform automatically encrypts all imported state files, so no risk exists.

C Sensitive data like passwords or keys may be stored in the state file if not handled properly.

D Importing resources deletes all existing state data, causing data loss.

💡 Hint

Think about what information Terraform state files contain.

Terraform state files can contain sensitive information. Importing resources may add secrets or credentials to the state, so secure storage and encryption are important.

❓ Architecture

expert

Effect of mismatched Terraform configuration after import

You imported an AWS S3 bucket into Terraform state with terraform import aws_s3_bucket.mybucket my-bucket-name. However, your Terraform configuration defines the bucket with versioning enabled, but the actual bucket has versioning disabled. What will happen when you run terraform plan?

A Terraform will show a plan to enable versioning on the bucket to match the configuration.

B Terraform will ignore the versioning difference and show no changes.

C Terraform will delete the bucket and recreate it with versioning enabled.

D Terraform will fail with an error about versioning mismatch.

💡 Hint

Consider how Terraform handles differences between state and configuration.

Terraform compares the imported state with the configuration. If versioning is disabled in the actual bucket but enabled in config, Terraform plans to update the bucket to enable versioning.

Practice

1. What is the main purpose of terraform import in Terraform?

easy

A. To create new resources in the cloud

B. To update Terraform version

C. To delete resources from the cloud

D. To bring existing cloud resources into Terraform state management

Solution

1. Step 1: Understand Terraform state

   Terraform state tracks resources it manages. Existing resources outside Terraform are unknown to it.

2. Step 2: Role of terraform import

   The terraform import command adds existing resources to Terraform state without creating or deleting them.

3. Final Answer:

   To bring existing cloud resources into Terraform state management -> Option D

4. Quick Check:

   Import = Add existing resource to state [OK]

Hint: Import links existing resources to Terraform state [OK]

Common Mistakes:

• Thinking import creates new resources
• Confusing import with terraform apply
• Assuming import deletes resources

2. Which of the following is the correct syntax to import an AWS EC2 instance with ID i-1234567890abcdef0 into Terraform resource aws_instance.example?

easy

A. terraform import aws_instance i-1234567890abcdef0.example

B. terraform import aws_instance.example i-1234567890abcdef0

C. terraform import i-1234567890abcdef0 aws_instance.example

D. terraform import example.aws_instance i-1234567890abcdef0

Solution

1. Step 1: Identify correct command order

   The syntax is terraform import <resource_address> <resource_id>.

2. Step 2: Match resource address and ID

   Resource address is aws_instance.example, ID is i-1234567890abcdef0. So terraform import aws_instance.example i-1234567890abcdef0 matches syntax correctly.

3. Final Answer:

   terraform import aws_instance.example i-1234567890abcdef0 -> Option B

4. Quick Check:

   Import syntax = terraform import resource_address resource_id [OK]

Hint: Resource address first, then resource ID in import command [OK]

Common Mistakes:

• Swapping resource address and ID
• Using dot in wrong place
• Missing resource type or name

3. After running terraform import aws_s3_bucket.mybucket my-bucket-name, what will terraform plan show if the Terraform configuration matches the imported bucket exactly?

medium

A. Plan to delete the imported bucket.

B. Plan to create a new S3 bucket.

C. No changes. Terraform state matches configuration.

D. Error: Resource not found.

Solution

1. Step 1: Understand import effect

   Import adds existing resource to state but does not change configuration files.

2. Step 2: Compare state and config

   If configuration matches the imported resource exactly, terraform plan shows no changes needed.

3. Final Answer:

   No changes. Terraform state matches configuration. -> Option C

4. Quick Check:

   Matching config and state = no changes [OK]

Hint: Plan shows no changes if config matches imported state [OK]

Common Mistakes:

• Expecting terraform plan to create or delete after import
• Confusing import with apply
• Ignoring configuration mismatch

4. You ran terraform import aws_db_instance.db1 db-1234 but terraform plan shows the instance will be destroyed and recreated. What is the most likely cause?

medium

A. The Terraform configuration does not match the imported resource attributes

B. The import command was run with wrong resource ID

C. Terraform state file is corrupted

D. Terraform version is outdated

Solution

1. Step 1: Analyze import and plan mismatch

   If plan wants to destroy and recreate, it means config differs from imported resource state.

2. Step 2: Confirm configuration matches resource

   Mismatch in attributes causes Terraform to think resource needs replacement.

3. Final Answer:

   The Terraform configuration does not match the imported resource attributes -> Option A

4. Quick Check:

   Config mismatch causes resource replacement plan [OK]

Hint: Mismatch between config and imported resource causes replacement plan [OK]

Common Mistakes:

• Assuming import ID error always causes plan changes
• Blaming Terraform version without checking config
• Ignoring attribute differences

5. You want to import multiple existing AWS security groups into Terraform. Which approach ensures correct import and verification?

hard

A. Run terraform import for each security group, then run terraform plan to verify state matches configuration

B. Run terraform apply directly to create new security groups

C. Delete existing security groups and recreate with Terraform

D. Edit the Terraform state file manually to add security groups

Solution

1. Step 1: Import each existing security group

   Use terraform import with correct resource address and IDs for each group.

2. Step 2: Verify with terraform plan

   Run terraform plan to check if imported state matches configuration and no unexpected changes occur.

3. Final Answer:

   Run terraform import for each security group, then run terraform plan to verify state matches configuration -> Option A

4. Quick Check:

   Import each resource, then verify with plan [OK]

Hint: Import individually and verify with plan to avoid surprises [OK]

Common Mistakes:

• Skipping plan after import
• Trying to create duplicates with apply
• Manually editing state file causing errors