HashiCorp Terraform Associate (004) Question 187
Single answer7a Import existing infrastructure into your Terraform workspaceYour team has an existing AWS security group named "web-sg" that was created manually in the AWS console. You need Terraform to begin managing this resource without recreating it. A teammate has already written the following configuration in your workspace:
provider "aws" { region = "us-east-1" }
resource "aws_security_group" "web" { name = "web-sg" description = "Web tier access" vpc_id = "vpc-12345678" }
When you run terraform plan, Terraform shows that it will create a new security group. What is the best next step to bring the existing security group under Terraform management with the least disruption?
- A
Run
terraform import aws_security_group.web sg-0123456789abcdef0, then review the state and update the configuration so it matches the imported resource before applying changes. - B
Run
terraform applyso Terraform creates the resource in state, then manually edit the state file to point to the existing security group ID. - C
Run
terraform refreshso Terraform discovers the existing security group automatically and links it toaws_security_group.web. - D
Add
lifecycle { ignore_changes = all }to the resource and runterraform applyso Terraform adopts the existing security group without modifying it.
Show answer and explanation
Correct answer: A
Explanation
To import existing infrastructure into Terraform, you typically follow this sequence: define the resource block in configuration, run terraform import <resource_address> <remote_id>, and then run terraform plan to compare configuration against the real object now recorded in state. Import attaches an existing remote object to a Terraform resource address in state; it does not automatically generate complete configuration for that resource. Because of that, best practice is to make the configuration accurately reflect the imported object before applying, so Terraform does not attempt unexpected updates or replacement. This aligns with Terraform CLI import behavior documented by HashiCorp: import brings resources into state, while configuration must still be managed separately.
- A. Correct.
Correct. Import is the intended workflow for bringing an existing real-world object under Terraform management. The resource block must already exist in configuration, and
terraform importmaps the existing infrastructure object ID to that resource address in state. After import, you should runterraform planand reconcile any differences between the configuration and the actual remote object to avoid unintended changes on the next apply. - B. Incorrect.
Incorrect.
terraform applywould try to create a new security group because Terraform does not yet know that the existing object corresponds toaws_security_group.web. Manually editing state is risky and not a recommended primary workflow for adoption of existing infrastructure. - C. Incorrect.
Incorrect.
terraform refreshupdates state for resources Terraform is already tracking. It does not discover unmanaged infrastructure and cannot automatically associate an existing AWS security group with a new resource block in configuration. - D. Incorrect.
Incorrect.
ignore_changesonly affects how Terraform handles detected differences for attributes on resources already managed in state. It does not import or adopt unmanaged infrastructure. Also,ignore_changes = allis not the normal solution for initial resource adoption.