HashiCorp Terraform Associate (004) Question 188
Single answer7a Import existing infrastructure into your Terraform workspaceYour team has an Amazon EC2 instance that was created manually in AWS and is already running in production. You need Terraform to start managing this instance without recreating it. A teammate has already added the following resource block to the configuration:
resource "aws_instance" "web" { ami = "ami-0abc1234def567890" instance_type = "t3.micro" }
You are in the correct workspace and AWS credentials are configured. What is the most appropriate next step to bring the existing EC2 instance under Terraform management while minimizing risk?
- A
Run terraform import aws_instance.web i-0123456789abcdef0, then run terraform plan to review any configuration drift and update the configuration if needed.
- B
Run terraform apply so Terraform can detect the existing EC2 instance automatically and attach it to aws_instance.web in state.
- C
Run terraform refresh to discover the existing EC2 instance and create the state entry for aws_instance.web automatically.
- D
Delete the manually created EC2 instance, then run terraform apply so Terraform can recreate it under management.
Show answer and explanation
Correct answer: A
Explanation
The correct workflow for existing infrastructure is: write the resource block, run terraform import RESOURCE_ADDRESS ID, and then run terraform plan to validate that the configuration matches the imported object's real settings. Import adds the mapping to Terraform state; it does not generate complete configuration for the resource. Because of that, a post-import plan is critical to identify attributes that differ between configuration and the actual resource. This aligns with Terraform CLI import behavior and state management best practices described in HashiCorp Terraform documentation.
- A. Correct.
Correct. To manage existing infrastructure with Terraform, you must first define a matching resource block in configuration and then use terraform import to associate the real-world object with that resource address in state. After import, running terraform plan is a best practice because the current configuration may not fully match the imported resource's actual settings. Reviewing the plan helps you identify drift or missing arguments before making changes.
- B. Incorrect.
Incorrect. Terraform does not automatically discover and attach existing infrastructure to a resource block during terraform apply. Without import, Terraform treats aws_instance.web as a resource it needs to create, which can lead to a plan proposing a new instance rather than adopting the existing one.
- C. Incorrect.
Incorrect. terraform refresh updates state from real infrastructure for resources that are already tracked in state. It does not create new state entries for unmanaged infrastructure. A common misconception is that refresh performs discovery, but import is the mechanism used to associate existing infrastructure with a Terraform resource address.
- D. Incorrect.
Incorrect. This is unnecessary and risky for a production system. Terraform import exists specifically to bring existing infrastructure under management without destroying and recreating it. Deleting a live production instance would introduce avoidable downtime and operational risk.