Terraform Resource Import Discovery Fix

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15–30 mins

TL;DR

• What broke: terraform import wrote a state entry, but the resource ID, address, or HCL schema doesn't match what the provider actually returns on read — so the next plan/apply tries to fetch a resource that doesn't exist under that key.
• How to fix it: Verify the exact ID format the provider expects (check provider docs, not AWS console), confirm the resource address matches your module path, then re-import with the corrected ID and reconcile the HCL attributes against terraform state show.
• Shortcut: Use our Client-Side Sandbox above to auto-refactor this — paste your failing config and state output, and it generates the corrected import command and HCL block locally without sending your ARNs anywhere.

Error: error reading <Resource> (<ID>): ResourceNotFoundException: Resource not found
  with aws_security_group.main,
  on main.tf line 12, in resource "aws_security_group" "main":
  12: resource "aws_security_group" "main" {

Error: resource not found

The resource <resource_address> with ID <id> could not be found.
This usually means the resource was deleted outside of Terraform.

How to Fix It (The Solution)

Step 1 — Verify the resource actually exists

Before touching Terraform, confirm the resource is live:

# AWS example — security group
aws ec2 describe-security-groups --group-ids sg-0abc1234567890def --region us-east-1

# If this returns an error, the resource is gone. Remove state entry:
terraform state rm aws_security_group.main

Step 2 — Check the exact ID format the provider expects

This is where 80% of import failures originate. Do not guess the ID format from the AWS console URL.

Check the provider registry docs for the specific resource: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/<resource_name>#import

Every resource page has an Import section at the bottom with the exact format.

Basic Fix — Re-import with correct ID

# WRONG — used ARN, provider expects bare ID
- terraform import aws_security_group.main arn:aws:ec2:us-east-1:123456789012:security-group/sg-0abc1234567890def

# CORRECT — provider expects the sg-* ID only
+ terraform import aws_security_group.main sg-0abc1234567890def

For module-scoped resources:

# WRONG — flat address, resource lives inside a module
- terraform import aws_security_group.main sg-0abc1234567890def

# CORRECT — full module path required
+ terraform import module.networking.aws_security_group.main sg-0abc1234567890def

After re-import, immediately run:

terraform state show aws_security_group.main

Compare every attribute against your HCL. Any attribute Terraform shows that isn't in your config will cause a plan diff or error.

Enterprise Best Practice — Reconcile HCL against state output

After import, the HCL block must reflect reality, not your assumption of what the resource looks like.

 resource "aws_security_group" "main" {
   name        = "prod-app-sg"
   description = "Production app security group"
   vpc_id      = "vpc-0def456"
 
+  # lifecycle block REQUIRED post-import to prevent description drift triggering replacement
+  lifecycle {
+    ignore_changes = [description]
+  }
 
-  # Hardcoding computed tags causes permanent diff — remove or use data source
-  tags = {
-    "aws:cloudformation:stack-name" = "legacy-stack"
-  }
+  tags = {
+    Name        = "prod-app-sg"
+    Environment = "production"
+  }
 }

For provider alias issues (wrong region/account):

 terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+    aws.eu = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
   }
 }
 
+provider "aws" {
+  alias  = "eu"
+  region = "eu-west-1"
+}
 
 resource "aws_security_group" "main" {
+  provider = aws.eu
   name     = "prod-app-sg"
 }

Import with alias:

terraform import -provider=aws.eu aws_security_group.main sg-0abc1234567890def

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

#!/bin/bash
set -e
terraform import "$RESOURCE_ADDRESS" "$RESOURCE_ID"
terraform plan -detailed-exitcode  # exits 2 if there are changes — fail the pipeline

# import.tf — committed to version control, reviewed in PR
import {
  to = aws_security_group.main
  id = "sg-0abc1234567890def"
}

terraform plan -generate-config-out=generated.tf

checkov -d . --check CKV_TF_1  # Ensures module sources are pinned
# Add custom check for dangling state references

package terraform.state

deny[msg] {
  resource := input.resource_changes[_]
  resource.change.actions[_] == "read"
  resource.change.after == null
  msg := sprintf("Resource %v returned null on read — possible bad import ID", [resource.address])
}

required_providers {
  aws = {
    source  = "hashicorp/aws"
    version = "= 5.31.0"  # Pin exact version during import operations
  }
}