How Does terraform import Work and When Would You Use It?
Learn how terraform import binds existing resources into Terraform state, why HCL must be written manually, and when to use it — interview-ready.
Expected Interview Answer
`terraform import` brings an existing resource that was created outside Terraform — manually in a console, via another tool, or from a legacy setup — under Terraform’s management by binding it to a resource address in the state file, but it does not generate the matching HCL configuration, so you must write that configuration yourself to match the real resource before applying.
The workflow has three parts: first you write a resource block in your `.tf` files with the correct type and a chosen local name but no attributes filled in yet, then you run `terraform import <resource_address> <real_resource_id>`, which queries the provider for that resource’s current attributes and writes them into the Terraform state file, associating them with your resource address. Critically, import only populates the state — it does not write or infer the HCL configuration, so if your `.tf` file’s arguments do not match what is actually in the state, the very next `terraform plan` will show a diff trying to change the real resource to match your (possibly wrong) configuration, which can cause unintended changes. The safe pattern is to run `terraform plan` immediately after import and iteratively adjust the HCL until the plan shows zero changes, confirming the configuration accurately describes the imported resource. This is commonly used when adopting IaC for infrastructure that predates it, after a manual emergency fix that created a new untracked resource, or when merging acquired infrastructure into an existing Terraform-managed estate.
- Brings legacy or manually created resources under IaC management without recreating them
- Avoids costly and risky resource recreation just to get resources into Terraform
- Enables a gradual, low-risk migration to infrastructure-as-code
- Lets teams consolidate acquired or externally managed infrastructure into one source of truth
AI Mentor Explanation
terraform import is like formally registering a player who has been turning up and playing informally for years, adding them to the official squad roster without changing anything about how they actually play. Registering them only updates the paperwork, it does not automatically write down their exact batting stance or bowling action — someone still has to document those details accurately. If the written profile does not match how the player actually plays, the next team strategy session will plan around the wrong assumptions. Coaches verify the profile against the player’s real game before relying on it for team selection.
Step-by-Step Explanation
Step 1
Write a matching resource block
Add an empty or best-guess resource block in HCL with the correct type and a chosen local name.
Step 2
Run terraform import
Execute `terraform import <address> <real_id>` to bind the real resource to that address in state.
Step 3
Inspect and reconcile with plan
Run `terraform plan` and compare the diff against the actual resource attributes.
Step 4
Iterate until plan is clean
Adjust the HCL arguments until `terraform plan` shows zero changes, confirming config matches reality.
What Interviewer Expects
- Understanding that import only updates state, never generates HCL configuration
- Knowledge of the mandatory follow-up plan/reconcile step to avoid unintended changes
- Awareness of realistic use cases like legacy adoption or acquired infrastructure
- Ability to explain the risk of a mismatched configuration causing a destructive apply
Common Mistakes
- Assuming terraform import automatically writes the matching HCL configuration
- Running terraform apply immediately after import without first checking terraform plan
- Importing a resource into the wrong resource address or type
- Forgetting that resources with complex nested attributes often need multiple iterations to reconcile
Best Answer (HR Friendly)
“terraform import lets us bring a resource that already exists — maybe something created manually years ago — under Terraform’s management without recreating it. It only updates Terraform’s state file though, so I always have to write the matching configuration myself and keep running a plan until it shows no changes, which confirms my code accurately describes what is really running.”
Code Example
# 1. Add a resource block in main.tf first (arguments can start empty)
# resource “aws_security_group” "legacy_sg" {}
# 2. Import the real resource into that address
terraform import aws_security_group.legacy_sg sg-0123456789abcdef0
# 3. Check what state now holds vs your config
terraform plan
# 4. Update main.tf to match, repeat plan until it shows "No changes"Follow-up Questions
- Why does terraform import not generate the HCL configuration automatically?
- What could go wrong if you run terraform apply right after import without checking plan?
- How would you import a resource with many nested or computed attributes?
- What alternative tools exist to bulk-generate configuration for imported resources?
MCQ Practice
1. What does terraform import actually modify?
terraform import writes the resource’s current attributes into the state file under the given address; it does not touch or generate .tf configuration.
2. What must you do immediately after running terraform import to avoid unintended changes?
Since import does not write matching HCL, a mismatched configuration will show a diff on the next plan; you must adjust the HCL until plan is clean.
3. What is a typical real-world use case for terraform import?
Import is commonly used to adopt IaC for pre-existing infrastructure, such as legacy resources or resources from acquired systems, without recreating them.
Flash Cards
What does terraform import update? — Only the Terraform state file — it binds a real resource ID to a resource address.
Does import generate HCL config? — No — you must write the matching configuration yourself.
Safe workflow after import? — Run terraform plan repeatedly and adjust HCL until it shows zero changes.
Common use case for import? — Adopting IaC for legacy or manually created resources without recreating them.