# Terraform workflow: brownfield import of existing infrastructure
## When
Infrastructure exists (console, CloudFormation, another tool) and Terraform needs to adopt it without recreation.
## Steps
1. Inventory: list every real object in scope (console, CLI, tagging). You cannot import what you have not listed, and missed objects become drift later.
2. Write import blocks with verified IDs (see the import-ID diagnostic). Group by resource type. For many objects, `for_each` on import blocks beats hand-writing dozens.
3. Write minimal resource blocks to receive the imports, or use `-generate-config-out` to generate starting config. Generated config is a draft: review and normalize it (naming, tags, structure) before keeping.
4. `terraform plan`: the import preview shows what will be adopted. Then `terraform apply` performs the imports.
5. Converge: the post-import plan will show diffs (generated config rarely matches reality exactly). Iterate on config until `terraform plan` is clean. Config describes reality now.
## Rules for agents
1. Never import directly into the production workspace first. Practice the full loop on a copy or a non-prod account; import IDs and generated config always need one iteration.
2. Import in dependency order where it matters, or all at once with import blocks and let Terraform sort it out. Do not import half the objects and apply config changes in the same run.
3. The converged clean plan is the definition of done. "Imported" without a clean plan is half-adopted and will surprise the next apply.
4. After adoption, delete the import blocks or keep them as origin records, and set up the normal CI plan/apply flow. Brownfield done right ends as greenfield workflow.