Grep the state list terraform
Filter managed addresses to find what TF tracks before surgery
terraform state list | grep -i 'aws_iam'
more terraform
all 43 commands →
Config-driven import block
cat > import.tf <<'EOF'
import {
to = aws_instance.web
id = "<id>"
}
EOF
terraform plan -generate-config-out=generated.tf
Refactor with moved block
cat >> moved.tf <<'EOF'
moved {
from = aws_instance.web
to = aws_instance.app
}
EOF
Replace resource (modern taint)
terraform apply -replace='aws_instance.web'
Surgical targeted plan
terraform plan -target='module.db.aws_db_instance.main'
Refresh-only plan (detect drift)
terraform plan -refresh-only