# Terraform import fails with "already exists": the ID is wrong or it is already managed

## What you are seeing

Variants include provider errors like `Error: ... already exists`, `InvalidParameterValue: ... already exists`, or Terraform refusing because the target address is already in state. You ran an import (block or CLI) and the provider says the thing is already there.

## First response

1. Check whether the target address is already in state: `terraform state list | grep [name]`. If the address exists, you do not need to import; you need to reconcile config with the existing object.
2. Verify the import ID format against the provider docs. Import IDs are provider-specific and often not the obvious identifier: AWS security groups want `sg-xxx`, but some resources want `name/vpc-id` composites. A wrong ID can resolve to an existing different object.
3. For `import` blocks: Terraform 1.5+ plans the import before applying it. Run `terraform plan` first; the plan shows exactly what will be imported and flags conflicts before anything changes.
4. If the provider reports the remote object already exists under a different Terraform address, someone imported it before. Find the existing address with `terraform state list` and either use it or `terraform state mv` the old address away first.

## Rules for agents

1. Never import into an address that already has state. Remove or move the old state entry first, deliberately.
2. Import does not generate config by itself (unless you use `-generate-config-out`, which writes a starting-point file you must review). An import without matching config just creates perpetual diffs.
3. After a successful import, the next plan must be clean or explainable. If it wants to destroy/recreate, the config does not match reality; fix the config, not the state.