Skip to content

004 · Domain 7: Maintain infrastructure with Terraform · 12% of the exam

Task 7.1: Import existing infrastructure into your Terraform workspace

Bringing existing objects under management: import blocks planned and applied like any change, generated configuration with -generate-config-out, for_each in import blocks, and the terraform import command.

Study it

  • Importing existing infrastructure: import blocks, generated configuration, the import command

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A storage bucket was created by hand and must now be managed by Terraform. The team writes a matching resource block and wants to preview the import in a plan before anything is recorded. What should it add?

  1. AA data block for the bucket, which Terraform converts to a managed resource on apply
  2. BA moved block from the bucket's cloud ID to the resource address
  3. CA lifecycle block with ignore_changes = all, so Terraform adopts the bucket as it is
  4. DAn import block with to and id, then plan and apply
Show the answer and why
  • AA data block for the bucket, which Terraform converts to a managed resource on apply

    Incorrect

    Data sources only read objects; they never become managed resources.

  • BA moved block from the bucket's cloud ID to the resource address

    Incorrect

    moved changes addresses of objects already in state; it cannot bring in new objects.

  • CA lifecycle block with ignore_changes = all, so Terraform adopts the bucket as it is

    Incorrect

    ignore_changes affects updates of managed objects; it does not import anything.

  • DAn import block with to and id, then plan and apply

    Correct

    Import blocks are part of the configuration, so the import appears in the plan for review and is recorded in state on apply.

Import blocks make imports part of the normal plan and apply workflow.

Question 2 · choose 1

A team must bring forty existing firewall rules under Terraform and has no configuration for them. It has written import blocks for all forty. Which command produces starting configuration for them?

  1. Aterraform import -generate-config for each rule
  2. Bterraform plan -generate-config-out=generated.tf
  3. Cterraform show -json > generated.tf, then rename the attributes
  4. Dterraform console with an export command
Show the answer and why
  • Aterraform import -generate-config for each rule

    Incorrect

    The import command only imports into state and never generates configuration.

  • Bterraform plan -generate-config-out=generated.tf

    Correct

    With import blocks for resources that have no configuration, plan -generate-config-out writes HCL for them to a new file; the feature is marked experimental.

  • Cterraform show -json > generated.tf, then rename the attributes

    Incorrect

    show -json prints JSON state, which is not usable as configuration.

  • Dterraform console with an export command

    Incorrect

    console evaluates expressions; it has no export of configuration.

Generated configuration is a template: review it, trim it and move it into the right files before applying.

Question 3 · choose 1

An engineer runs terraform import aws_instance.legacy i-0abc123 in a configuration that has no aws_instance.legacy block. What happens?

  1. AIt fails; terraform import needs an existing resource block
  2. BThe instance is imported, and a matching resource block is written to imported.tf
  3. CThe instance is imported into state, and the next plan keeps it
  4. DTerraform creates a new instance with the same settings
Show the answer and why
  • AIt fails; terraform import needs an existing resource block

    Correct

    Before running terraform import you must write a resource block that describes where to map the imported object; the command does not generate configuration.

  • BThe instance is imported, and a matching resource block is written to imported.tf

    Incorrect

    The CLI command never writes configuration.

  • CThe instance is imported into state, and the next plan keeps it

    Incorrect

    Without a block, the address is invalid; even if state held it, a plan would destroy it.

  • DTerraform creates a new instance with the same settings

    Incorrect

    Import never creates infrastructure.

The import command writes state only, into an address your configuration already has.

Question 4 · choose 1

Importing an EC2 instance uses its instance ID, but importing a DNS zone uses a zone ID. Where does a practitioner find the right import ID for a resource type?

  1. AIn terraform.tfstate of another project
  2. BIn the Terraform CLI configuration file
  3. CIn that resource's provider documentation
  4. DIt is always the resource's display name in the console
Show the answer and why
  • AIn terraform.tfstate of another project

    Incorrect

    Another project's state is not a reference for import formats.

  • BIn the Terraform CLI configuration file

    Incorrect

    The CLI configuration has no import settings.

  • CIn that resource's provider documentation

    Correct

    The import ID depends on the resource type; the provider documentation describes the format.

  • DIt is always the resource's display name in the console

    Incorrect

    Formats differ by resource type and are rarely just a name.

Import IDs are provider-specific; read the resource's page.

Question 5 · choose 1

An engineer reruns the configuration-generation step of an import, and the output file named in the command is still in the directory from the previous attempt. What happens?

  1. ATerraform returns an error, because the output path must not exist yet
  2. BTerraform appends the new resource blocks to the end of the existing file
  3. CTerraform overwrites the file with fresh configuration
  4. DTerraform writes to a new file with a numbered suffix next to the old one
Show the answer and why
  • ATerraform returns an error, because the output path must not exist yet

    Correct

    You must supply a new file path; an existing file causes an error.

  • BTerraform appends the new resource blocks to the end of the existing file

    Incorrect

    Terraform does not append to existing files.

  • CTerraform overwrites the file with fresh configuration

    Incorrect

    It refuses to overwrite.

  • DTerraform writes to a new file with a numbered suffix next to the old one

    Incorrect

    There is no automatic renaming.

Generated configuration always goes to a new file you name.

Question 6 · choose 1

A brand-new configuration contains only import blocks for some DNS records and no other resources from the DNS provider. Generating configuration fails because Terraform cannot determine which provider to use. What is missing?

  1. AA moved block that names the DNS provider for the imported records
  2. BA data source for each record
  3. CAn output that exposes each record's ID
  4. DA provider block, followed by terraform init
Show the answer and why
  • AA moved block that names the DNS provider for the imported records

    Incorrect

    moved blocks change addresses.

  • BA data source for each record

    Incorrect

    Data sources do not tell import which provider to use.

  • CAn output that exposes each record's ID

    Incorrect

    Outputs expose values; they do not select providers.

  • DA provider block, followed by terraform init

    Correct

    If no other resources use the provider, add a provider block so Terraform knows which provider generates the configuration, and re-run init.

Configuration generation still needs a provider to ask for attribute values.

Question 7 · choose 1

A plan with import blocks reports "Plan: 3 to import, 0 to add, 0 to change, 0 to destroy." What will the apply do to the real infrastructure?

  1. AIt re-creates the three objects so that Terraform owns them from now on
  2. BNothing; it records them in state
  3. CIt tags the three objects as managed by Terraform
  4. DIt copies the three objects into a new account
Show the answer and why
  • AIt re-creates the three objects so that Terraform owns them from now on

    Incorrect

    Import never re-creates objects.

  • BNothing; it records them in state

    Correct

    Import brings existing resources into state; Terraform records that it imported them rather than created them.

  • CIt tags the three objects as managed by Terraform

    Incorrect

    Import changes state, not the objects.

  • DIt copies the three objects into a new account

    Incorrect

    Nothing is copied.

Import changes Terraform's records, not the infrastructure.

Question 8 · choose 1

When do the docs recommend writing the resource block by hand rather than generating configuration during import?

  1. AWhen the import runs in an HCP Terraform workspace instead of locally
  2. BWhen you already know most of the resource's arguments
  3. CWhen the resource sits inside a child module
  4. DWhen the import uses the CLI command instead of an import block
Show the answer and why
  • AWhen the import runs in an HCP Terraform workspace instead of locally

    Incorrect

    Where the run happens does not decide this; the recommendation turns on how much of the resource's configuration you already know.

  • BWhen you already know most of the resource's arguments

    Correct

    The docs recommend writing the resource block manually when you know most arguments, and generated configuration for many or complex resources.

  • CWhen the resource sits inside a child module

    Incorrect

    Module placement does not decide this.

  • DWhen the import uses the CLI command instead of an import block

    Incorrect

    The recommendation is about how much of the configuration you already know, not about the import method.

Hand-write what you know; generate what you do not.

Practise domain 7 →Practise all domains →