Labsco
hashicorp logo

terraform-search-import

✓ Official★ 697

by hashicorp · part of hashicorp/agent-skills

Discover existing cloud resources using Terraform Search queries and bulk import them into Terraform management. Use when bringing unmanaged infrastructure…

🔥🔥🔥🔥✓ VerifiedFreeQuick setup
#automation#cloud#devops#git
🧩 One of 7 skills in the hashicorp/agent-skills package — works on its own, and pairs well with its siblings.

Discover existing cloud resources using Terraform Search queries and bulk import them into Terraform management. Use when bringing unmanaged infrastructure…

Inspect the full instructions your agent will receiveExpand

This is the exact playbook injected into your agent when the skill activates — shown here so you can audit it before installing. You don't need to read it to use the skill.

by hashicorp

Discover existing cloud resources using Terraform Search queries and bulk import them into Terraform management. Use when bringing unmanaged infrastructure… npx skills add https://github.com/hashicorp/agent-skills --skill terraform-search-import Download ZIPGitHub697

Terraform Search and Bulk Import

Discover existing cloud resources using declarative queries and generate configuration for bulk import into Terraform state.

References:

When to Use

  • Bringing unmanaged resources under Terraform control

  • Auditing existing cloud infrastructure

  • Migrating from manual provisioning to IaC

  • Discovering resources across multiple regions/accounts

IMPORTANT: Check Provider Support First

BEFORE starting, you MUST verify the target resource type is supported:

Copy & paste — that's it
# Check what list resources are available
./scripts/list_resources.sh aws # Specific provider
./scripts/list_resources.sh # All configured providers

Decision Tree

Identify target resource type (e.g., aws_s3_bucket, aws_instance)

Check if supported: Run ./scripts/list_resources.sh <provider>

Choose workflow:

  • ** If supported**: Check for terraform version available.

  • ** If terraform version is above 1.14.0** Use Terraform Search workflow (below)

  • ** If not supported or terraform version is below 1.14.0 **: Use Manual Discovery workflow (see references/MANUAL-IMPORT.md)

Note: The list of supported resources is rapidly expanding. Always verify current support before using manual import.

Terraform Search Workflow (Supported Resources Only)

  • Create .tfquery.hcl files with list blocks defining search queries

  • Run terraform query to discover matching resources

  • Generate configuration with -generate-config-out=<file>

  • Review and refine generated resource and import blocks

  • Run terraform plan and terraform apply to import

Query File Structure

Query files use .tfquery.hcl extension and support:

  • provider blocks for authentication

  • list blocks for resource discovery

  • variable and locals blocks for parameterization

Copy & paste — that's it
# discovery.tfquery.hcl
provider "aws" {
 region = "us-west-2"
}

list "aws_instance" "all" {
 provider = aws
}

List Block Syntax

Copy & paste — that's it
list "
- " " " {
 provider = # Required

 # Optional: filter configuration (provider-specific)
 # The `config` block schema is provider-specific. Discover available options using `terraform providers schema -json | jq '.provider_schemas."registry.terraform.io/hashicorp/ ".list_resource_schemas." "'`

 config {
 filter {
 name = " "
 values = [" ", " "]
 }
 region = " " # AWS-specific
 }
 # Optional: limit results
 limit = 100
}

Supported List Resources

Provider support for list resources varies by version. Always check what's available for your specific provider version using the discovery script.

Query Examples

Basic Discovery

Copy & paste — that's it
# Find all EC2 instances in configured region
list "aws_instance" "all" {
 provider = aws
}

Filtered Discovery

Copy & paste — that's it
# Find instances by tag
list "aws_instance" "production" {
 provider = aws
 
 config {
 filter {
 name = "tag:Environment"
 values = ["production"]
 }
 }
}

# Find instances by type
list "aws_instance" "large" {
 provider = aws
 
 config {
 filter {
 name = "instance-type"
 values = ["t3.large", "t3.xlarge"]
 }
 }
}

Multi-Region Discovery

Copy & paste — that's it
provider "aws" {
 region = "us-west-2"
}

locals {
 regions = ["us-west-2", "us-east-1", "eu-west-1"]
}

list "aws_instance" "all_regions" {
 for_each = toset(local.regions)
 provider = aws
 
 config {
 region = each.value
 }
}

Parameterized Queries

Copy & paste — that's it
variable "target_environment" {
 type = string
 default = "staging"
}

list "aws_instance" "by_env" {
 provider = aws
 
 config {
 filter {
 name = "tag:Environment"
 values = [var.target_environment]
 }
 }
}

Query Output Format

Copy & paste — that's it
list.aws_instance.all account_id=123456789012,id=i-0abc123,region=us-west-2 web-server

Columns: <query_address> <identity_attributes> <name_tag>

Post-Generation Cleanup

Generated configuration includes all attributes. Clean up by:

  • Remove computed/read-only attributes

  • Replace hardcoded values with variables

  • Add proper resource naming

  • Organize into appropriate files

Copy & paste — that's it
# Before: generated
resource "aws_instance" "all_0" {
 ami = "ami-0c55b159cbfafe1f0"
 instance_type = "t2.micro"
 arn = "arn:aws:ec2:..." # Remove - computed
 id = "i-0abc123" # Remove - computed
 # ... many more attributes
}

# After: cleaned
resource "aws_instance" "web_server" {
 ami = var.ami_id
 instance_type = var.instance_type
 subnet_id = var.subnet_id
 
 tags = {
 Name = "web-server"
 Environment = var.environment
 }
}

Import by Identity

Generated imports use identity-based import (Terraform 1.12+):

Copy & paste — that's it
import {
 to = aws_instance.web
 provider = aws
 identity = {
 account_id = "123456789012"
 id = "i-0abc123"
 region = "us-west-2"
 }
}

Best Practices

Query Design

  • Start broad, then add filters to narrow results

  • Use limit to prevent overwhelming output

  • Test queries before generating configuration

Configuration Management

  • Review all generated code before applying

  • Remove unnecessary default values

  • Use consistent naming conventions

  • Add proper variable abstraction

Complete Example

Copy & paste — that's it
# main.tf - Initialize provider
terraform {
 required_version = ">= 1.14"
 required_providers {
 aws = {
 source = "hashicorp/aws"
 version = "~> 6.0" # Always use latest version
 }
 }
}

# discovery.tfquery.hcl - Define queries
provider "aws" {
 region = "us-west-2"
}

list "aws_instance" "team_instances" {
 provider = aws
 
 config {
 filter {
 name = "tag:Owner"
 values = ["platform"]
 }
 filter {
 name = "instance-state-name"
 values = ["running"]
 }
 }
 
 limit = 50
}
Copy & paste — that's it
# Execute workflow
terraform init
terraform query
terraform query -generate-config-out=generated.tf
# Review and clean generated.tf
terraform plan
terraform apply