Terraform Import: What is it and How to Use it?

Manually managing cloud infrastructure across multiple providers can be challenging, especially for businesses that rely on Infrastructure as Code (IaC). One common issue is configuration drift, where infrastructure changes made outside of IaC tools lead to security vulnerabilities, such as outdated firewall rules or excessive access permissions.

While importing existing infrastructure into Terraform helps centralize resource management, teams often face difficulties integrating these resources into automated workflows. However, Terraform Import allows you to bring unmanaged cloud resources into Terraform’s state without rebuilding them, enabling consistent and efficient infrastructure management.

In this guide, we’ll take you through a step-by-step Terraform import process, making it easier to transition your cloud resources into a fully automated IaC environment.

What is Terraform Import Command?

Terraform Import is a Terraform CLI command that allows teams to bring cloud resources under Terraform’s management. The Terraform Import command adds each resource block to its state files, even if third-party providers manage some of them.?

This function is highly valuable for a business infrastructure that was manually created but now requires Infrastructure as Code management using Terraform. However, a key limitation of the command is that it does not generate the corresponding configuration (.tf) files automatically.?

It only records the resource in the state file, meaning you must manually create the Terraform configuration to match the imported cloud resource.

Why Terraform Import Matters for Your DevOps?

• Ensures Terraform recognizes existing cloud resources without recreating them, eliminating resource duplication.
• It enables incremental adoption of Terraform, allowing teams to transition from manual infrastructure management to IaC incrementally.
• Once imported, Terraform can track and manage these resources, improving consistency and collaboration.

How to Use Terraform Import?

Bringing your existing infrastructure under Terraform’s management enhances version control, maintainability, and consistency.?

Step 1: Preparation

Start by auditing your cloud and on-prem infrastructure to determine which resources should be managed by Terraform.

Assessing Your Existing Infrastructure

Build a clear list of currently available resources across your cloud environments. This list includes virtual machines, databases, networking components, etc. Why assess? Not all infrastructure components need immediate Terraformization. Focus on resources that benefit from automation while leaving non-critical legacy systems untouched.

Gathering Necessary Resource Identifiers

Acknowledge the potential challenges you can face when you initiate the import process. Terraform depends on unique identifiers to map existing resources into its state file. Your team should collaborate with cloud engineers to gather these identifiers from AWS, Azure, GCP, or on-prem systems.

• AWS Resources: EC2 instance IDs, S3 bucket names, IAM ARNs.
• Azure Resources: Virtual machine names, resource group names, network security groups.
• GCP Resources: Compute instance IDs and storage bucket names.

Failure to identify correct resource identifiers can lead to failed imports, misconfigured infrastructure, and potential service downtime.

Understanding Resource Dependencies

Gather existing configuration details and note any custom settings or unique parameters that could influence the import. Why does this matter for your business? Because many cloud resources are interdependent.?

For example, If you import an EC2 instance but fail to import its associated security group, IAM role, or storage volume, your Terraform configuration may not reflect the actual state of your infrastructure.

• Dependency Mapping: Before importing, map out relationships between cloud resources. For example, an RDS database might depend on VPC subnets, security groups, and IAM policies.
• Risk Mitigation: Unintentional resource deletions or misconfigurations can cause unprompted downtime.
• State Synchronization Strategy: Check that cloud resources are imported in the right sequence to maintain Terraform state consistency.

Tech Tip for Businesses: As a tech expert helping businesses adopt Terraform at scale, I have found implementing Terraform State Locking crucial. It helps prevent multiple engineers from making conflicting changes during imports, saving your team from potential headaches and ensuring smoother infrastructure management.

Step 2: Writing Terraform Configuration

Terraform’s ‘apply’ command allows you to add new resources. However, the ‘terraform import’ command only adds resources to Terraform’s state file. This means your team must manually define configurations for each imported resource.

Define Resource Blocks

Every cloud resource that is imported into Terraform state files requires a Terraform configuration block. This includes parameters like:

• Ensuring your cloud providers, like AWS, Azure, and GCP, are specified in the .tf files.
• Defining each resource by adding instance type, security settings, and networking details.
• If different teams have manually modified cloud resources, ensure their settings align with Terraform definitions before importing.

Example for Defining Configuration block before Performing Terraform Import Process: Defining an AWS EC2 instance in Terraform:

Leverage Provider Documentation

Terraform configurations for different cloud providers are available in a documented format that fulfills different services. Before importing your cloud infrastructure, refer to the official documentation to ensure the following:

• Required key attributes are correctly defined.
• Disapproved parameters are avoided.
• Cloud resource-specific best practices are followed.
• AWS Provider Docs: Terraform AWS Provider
• Azure Provider Docs: Terraform Azure Provider
• GCP Provider Docs: Terraform GCP Provider

Version Control Your Configurations:

Every imported resource should be tracked in a version control system (VCS) like Git. This process ensures that:

• Change history is maintained for audits and compliance.
• Rollbacks are possible in case of incorrect configurations.
• Team collaboration is retained that prevents accidental overwrites.

Best Practice: Implement branch-based workflows for Terraform changes. For example, maintain a ‘staging” branch for testing configurations before merging them into ‘production.’

Example: To check AWS EC2 Instances before importing, use the following command:

bash

aws ec2 describe-instances --filters "Name=tag:Environment,Values=Production"

Step 3: Execution

You can initiate the Terraform Import process once your infrastructure audit is complete and the configurations are defined. This means that your cloud resources are mapped to Terraform’s state file without system downtime or workflow disruption.

Initialize Terraform

Before running any import command, your team must initialize Terraform to download the necessary cloud provider plugins. This ensures that Terraform recognizes the cloud provider configurations and can manage the resources properly.

bash

terraform init

The command also helps you confirm the Terraform state backend (S3, GCP Storage, etc.).

Execute the Import Command

The actual import process begins here! This step links the existing cloud resource to its Terraform state. It does not change or modify the resource but keeps track of it in Terraform.

bash

terraform import aws_instance.my_instance i-0abcd1234efgh5678

• aws_instance.my_instance: The Terraform resource block is defined in the .tf file.
• i-0abcd1234efgh5678: The actual ID of the EC2 instance being imported.

Pro tip: If multiple team members are importing resources, document every import in a shared repository to avoid conflicts.

Verify the Imported Resource

Your development team must ensure that Terraform recognizes the imported resource. For that, you can use this command:

bash

terraform state list

Moreover, if Terraform shows the imported resource, run the following command:

bash

terraform plan

Note: If Terraform detects differences between the actual resource and the .tf file, adjust the configuration manually. Double-check the .tf configuration to match the cloud provider settings if it suggests destroying or recreating the imported resource.

Handle Complex Resources

Enterprise cloud environments contain interdependent resources that require a layered approach to avoid breaking configurations.

Why is this important?

• Large-scale infrastructure (e.g., RDS databases, Kubernetes clusters, IAM roles) cannot be imported as a single entity.
• Importing an EC2 instance without its IAM roles or security groups could lead to misconfigurations or failed imports.

We will understand this using the example of “Importing an AWS RDS Database with Dependencies.” A business may use an AWS RDS PostgreSQL database that requires:

• Subnet Groups
• Security Groups
• IAM Roles
• Monitoring Alarms

To import without downtime, initiate the process in the following sequence:

Step 1: Import the Subnet Group

bash

terraform import aws_db_subnet_group.my_subnet_group default

Ensures that the database has a network layer to connect to.

Step 2: Import the Security Group

bash

terraform import aws_security_group.my_db_sg sg-01234abcd5678efgh

Ensures that the database maintains its security rules.

Step 3: Import the RDS Database

bash

terraform import aws_db_instance.my_db my-database-id

Ensures Terraform can now manage the database configuration without changing its state.

Step 4: Post-Import Actions

You must ensure that Terraform accurately reflects the current infrastructure. Skipping post-import actions can cause significant damage to production environments, data loss, or Terraform drift.

Verify Imported Resource State

Terraform only imports resources to the state file but does not check for mismatches between your .tf files and actual cloud settings. The ‘Terraform plan’ command allows you to determine such abnormalities in resource configuration.

Impact: Misaligned configurations can lead to unwanted infrastructure modifications. Always ensure to update .tf files, preventing Terraform from accidentally modifying critical services.

Note: Before making any changes in production, validate the plan in a sandbox or non-production account to avoid disruptions.

Refine Configuration Files

• Compare Cloud Console Settings with .tf Files – Ensure that instance sizes, security group rules, IAM policies, and networking configurations are correctly defined.
• Adjust Configurations for Custom Attributes – Some settings (like encrypted S3 buckets or auto-scaling policies) may not be automatically visible in Terraform.
• Use Terraform State Pull for Verification – Run terraform state show <resource> to retrieve imported resource attributes.

Implement State Management Best Practices

As a cloud-based infrastructure owner, improper state management can lead to several unrealistic challenges to your customers' services. However, you can take effective measures to manage Terraform state:

• Store Terraform state files in AWS S3, Azure Blob, or Google Cloud Storage to prevent local inconsistencies.
• Prevent multiple engineers from making changes simultaneously using DynamoDB locks or Terraform Cloud's built-in locking mechanism.
• Keep a history of state files to rollback in case of incorrect imports.

Example: Remote State Storage Configuration (AWS S3 & DynamoDB):

Advanced Import Techniques

• Importing Resources into Modules: Terraform modules allow you to reuse infrastructure configurations across multiple environments, including staging and production. If a resource belongs to a module, you can import it using module-aware imports. The steps include:

• Ensure the module is correctly defined in the .tf file.
• Use the full module path in the import command.

Example: Importing an AWS Security Group inside a Module

bash

terraform import module.networking.aws_security_group.web_sg sg-01234abcd5678efgh

• Handling Multiple Instances or Imports: Terraform’s “count” and “for_each” features help business teams automate large-scale cloud resource imports. For example, learn to import 10 Identical EC2 Instances using “count.”

• Using the Terraform import Block (Terraform v1.5.0 and Later): With Terraform v1.5.0, HashiCorp introduced the import block. This game-changing enhancement allows organizations to define imports directly in their configuration files rather than running ad-hoc terraform import commands.

You can use it in CI/CD pipelines to automate imports via GitHub Actions, Terraform Cloud, or Jenkins, making every import trackable and auditable.

Terraform Import: The Bridge Between Legacy Systems and Modern IaC

Terraform represents a larger part of the cloud automation strategy where organizations can streamline cloud operations, improve resource tracking, and enhance team collaboration. All this is possible by migrating legacy infrastructure, recovering lost state files, and restructuring Terraform codebases.?

Terraform Import can help businesses transition their existing infrastructure into an Infrastructure as Code (IaC) framework without disrupting current operations. This process provides better visibility into resources, strengthens governance, and reduces manual errors.