Terraform Import

# Create the existing environment manually — this simulates pre-Terraform infrastructure
# Run these AWS CLI commands to build what we will import

# Create a VPC
aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=legacy-vpc},{Key=Environment,Value=prod}]'
# Note the VpcId from the output: vpc-0abc123def456789

# Create a subnet inside the VPC
aws ec2 create-subnet \
  --vpc-id vpc-0abc123def456789 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=legacy-subnet-a}]'
# Note the SubnetId: subnet-0abc123def456789

# Create a security group
aws ec2 create-security-group \
  --group-name legacy-web-sg \
  --description "Legacy web security group" \
  --vpc-id vpc-0abc123def456789
# Note the GroupId: sg-0abc123def456789

# Add an HTTP ingress rule to the security group
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123def456789 \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

# Create an S3 bucket
aws s3api create-bucket \
  --bucket legacy-app-data-prod \
  --region us-east-1

mkdir terraform-lesson-19
cd terraform-lesson-19
touch versions.tf imports.tf main.tf outputs.tf .gitignore

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# imports.tf — import blocks for every manually-created resource
# These run during terraform apply and bring each resource into state
# After successful apply, remove each block — it is no longer needed

# Import the existing VPC
import {
  to = aws_vpc.legacy            # Target address — will be created in main.tf
  id = "vpc-0abc123def456789"    # VPC ID from AWS CLI output
}

# Import the existing subnet
import {
  to = aws_subnet.legacy_a       # Target address
  id = "subnet-0abc123def456789" # Subnet ID from AWS CLI output
}

# Import the existing security group
import {
  to = aws_security_group.legacy_web  # Target address
  id = "sg-0abc123def456789"          # Security group ID from AWS CLI output
}

# Import the existing S3 bucket
# S3 bucket import ID is just the bucket name — not the ARN
import {
  to = aws_s3_bucket.legacy_data  # Target address
  id = "legacy-app-data-prod"     # Bucket name — exactly as created
}

# Initialize and generate configuration from the import blocks
terraform init

# Generate resource blocks from the real resources' current state
# This writes a file called generated.tf with complete resource blocks
terraform plan -generate-config-out=generated.tf

# main.tf — cleaned up from generated.tf
# Keep only the arguments you intend to manage
# Remove computed attributes that Terraform sets automatically

resource "aws_vpc" "legacy" {
  cidr_block           = "10.0.0.0/16"   # The CIDR we created with
  enable_dns_hostnames = false            # Default — we will leave this as-is
  enable_dns_support   = true             # Default — AWS enables this by default
  instance_tenancy     = "default"        # Default tenancy

  tags = {
    Environment = "prod"
    Name        = "legacy-vpc"
    ManagedBy   = "Terraform"  # Add this now — standard tag for all Terraform-managed resources
  }
}

resource "aws_subnet" "legacy_a" {
  vpc_id            = aws_vpc.legacy.id   # Reference by expression — not hardcoded ID
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"

  tags = {
    Name      = "legacy-subnet-a"
    ManagedBy = "Terraform"
  }
}

resource "aws_security_group" "legacy_web" {
  name        = "legacy-web-sg"
  description = "Legacy web security group"
  vpc_id      = aws_vpc.legacy.id  # Reference expression — not hardcoded

  ingress {
    description = "HTTP from anywhere"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "All outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name      = "legacy-web-sg"
    ManagedBy = "Terraform"
  }
}

resource "aws_s3_bucket" "legacy_data" {
  bucket = "legacy-app-data-prod"  # Must match existing bucket name exactly

  tags = {
    Name      = "legacy-app-data"
    ManagedBy = "Terraform"
  }
}

# Remove generated.tf — main.tf now contains the cleaned configuration
rm generated.tf

# Apply — this runs the import blocks and then applies any drift changes
terraform apply

# Verify — plan should show zero changes
terraform plan

# Confirm all four resources are in state
terraform state list

# Remove the import blocks from imports.tf — they are no longer needed
# The resources are now in state and will be managed normally going forward
# Either delete imports.tf or remove the import {} blocks from it