Importing what already exists, one resource at a time

Adopting Terraform on existing infrastructure is mostly import, and import brings a resource into state without writing any configuration for it.

$ terraform import aws_s3_bucket.uploads example-uploads
Import successful!

$ terraform plan
  # aws_s3_bucket.uploads must be replaced
  ~ acl = "private" -> "public-read"

# the configuration must be written to MATCH reality, by
# hand, until the plan is empty.

$ terraform plan -detailed-exitcode; echo $?
0        # 0 no changes, 1 error, 2 changes pending

One resource, one commit, one empty plan is the discipline that makes this survivable on a production account. Importing twenty things and then writing configuration produces a plan that wants to destroy something, and finding which line caused it is an afternoon spent nervously.