# Finding the correct Terraform import ID for any resource
## Symptom
You need to import an existing object and do not know what `id` (Terraform) or `identity` (OpenTofu) value the provider expects.
## Cause
Import IDs are arbitrary per provider: sometimes the plain ID (`i-abc123`), sometimes a composite (`vpc-id/subnet-id`), sometimes the ARN, sometimes the name. There is no universal rule.
## Confirmation
1. Provider registry docs for the resource, section "Import". This documents the exact ID format. Copy it verbatim.
2. If the docs are unclear, look at how the provider's Read function identifies the object: the ID is usually the primary identifier the API uses.
3. Trial in a scratch config: a minimal config with the import block (or `terraform import` CLI) against a non-production copy first. `terraform plan` with an import block shows what will be imported before anything changes.
## Fix
1. Write the import block with the verified ID format. For bulk imports, `for_each` on import blocks handles many objects of the same type.
2. Run `terraform plan`: the import section of the plan confirms each object resolves. Fix ID formats here, not during apply.
3. After apply, the next plan must be clean. If it is not, the config does not match the imported object; adjust config, not state.
## Verification
1. `terraform state list` shows the imported addresses.
2. Clean plan afterwards. An import that leaves a perpetual diff imported the wrong object or the wrong ID format.
3. Delete the scratch trial config. Import blocks can stay as documentation or be removed; either is fine, but be deliberate.