Import existing infrastructure with Terraform import blocks
An import block maps a remote identifier to one resource address during plan and apply; configuration must describe the object and each object should have one binding.
Refactor Terraform resource addresses with moved blocks
A moved block records an old and new address so Terraform updates the state binding instead of planning destroy and create for the same object.
Use Terraform prevent_destroy as a guard, not a backup
Prevent_destroy rejects a plan that would destroy a configured resource while the lifecycle rule remains present; it cannot recover data or protect an object after its block is removed.
Use Terraform provider lock files for reproducible initialization
The dependency lock file records selected provider versions and checksums while version constraints define which selections are allowed.
Reconcile Terraform state with remote drift using refresh-only mode
Refresh-only updates state and root outputs from provider observations without planning configuration-driven remote changes.
Use replace_triggered_by only for real lifecycle coupling
Replace_triggered_by adds replacement edges when referenced managed resources or attributes change; it is not a general string-expression trigger.
Apply the exact Terraform plan that reviewers approved
A saved plan captures the proposed operations and input context for one configuration and state snapshot, reducing but not eliminating drift between review and apply.
Protect Terraform sensitive values knowing state still stores them
Sensitive marks redact display in common CLI output, but Terraform state and plan files can still contain cleartext values needed by providers.
Use terraform state mv without rebinding the wrong object
State mv changes the resource address associated with an existing remote object and does not itself alter that object.
Make Terraform forget a resource without destroying it
State rm removes a binding from state while leaving the remote object intact; the next plan may propose creating a new object at the still-configured address.