Terraform · Infrastructure as code

How do you bring existing infrastructure under Terraform management?

MediumimportadoptionbrownfieldUpdated Oct 2026

Short answer

Import brings an existing resource under Terraform management by mapping its real ID to a configuration address. Write or generate matching configuration first, then plan until there are no unintended changes.

Importing is an adoption workflow, not a migration of the resource. Terraform records the existing object at a configuration address, then plans any differences between your configuration and reality. The hard part is writing configuration that matches the object closely enough to avoid a destructive diff.

hcl

import {
  to = aws_s3_bucket.logs
  id = "acme-logs-prod"
}

resource "aws_s3_bucket" "logs" {
  bucket = "acme-logs-prod"
}

The import block is declarative and reviewable. Run terraform plan, then apply to record the resource in state.

A safe adoption sequence

Back up state and confirm the resource ID
Write minimal matching configuration or generate it with -generate-config-out
Add the import block and run plan
Resolve every unexpected update or replacement before applying
Remove the import block after the resource is in state

The older CLI form, terraform import aws_s3_bucket.logs acme-logs-prod, still works but is imperative and does not create configuration. Prefer import blocks in version control because the adoption is reviewed like any other change and can be repeated across environments.

Import does not validate that your configuration is correct. A plan after import is mandatory, especially for resources with immutable arguments that would force replacement.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

1What is the difference between terraform import and an import block?
2Why does the configuration need to match the real resource?
3What does -generate-config-out do?
4What should you check immediately after an import?

Say it in the interview

Import maps an existing real resource to a Terraform address so it can be managed. I prefer declarative import blocks in version control, along with matching configuration, then I plan and resolve every unexpected diff before applying. I back up state first and check for immutable arguments that would force replacement. Import itself does not prove the configuration is correct, so the post-import plan is the real safety check.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.

Start a free Terraform interview Browse all questions

A safe adoption sequence

Follow-ups you should expect

Related questions

Now say it out loud.