In a perfect world, nobody touches the cloud console. In the real world, an on-call engineer fixes an outage at 2 AM by manually editing a security group or upgrading an instance in the AWS Console.
This discrepancy between desired code, recorded state, and actual cloud reality is called Configuration Drift.
1. Detecting Drift with terraform plan -refresh-only
Terraform provides a safe, non-destructive way to scan real cloud infrastructure and update the local state file without modifying cloud resources:
To accept the cloud changes into your state file:
2. Importing Existing Infrastructure into Terraform
What if your company has 50 existing AWS EC2 servers or S3 buckets that were created manually years ago before Terraform was introduced? You do not need to recreate them! You can import them.
Modern Declarative Import (Terraform 1.5+)
The modern way to import resources is using the native import {} block in HCL:
Now, tell Terraform to generate the exact HCL resource block automatically:
Terraform writes the corresponding resource "aws_s3_bucket" "legacy_data" block for you into generated_resources.tf!
Run apply to seal the import:
3. Refactoring Code Without Destroying Resources (moved {} Blocks)
In older versions of Terraform, if you renamed a resource in your HCL code (e.g. from aws_instance.server to aws_instance.primary_server), Terraform would destroy the running EC2 server and build a new one!
In modern Terraform, you prevent this with a moved {} block:
When you run terraform plan, Terraform detects the moved block and simply updates the internal state pointer: