Recognize infrastructure drift, import existing objects with configuration-driven intent, and choose reconciliation without accidentally replacing or abandoning resources.

What you will be able to do

Distinguish remote object from resource declaration in a realistic detect drift and import existing resources case.
Interpret the delivery evidence and boundary associated with import mapping.
Choose an appropriate action involving drift signal without exceeding the named operational scope.
Verify reconciliation choice through an observable service result and reproducible handoff.

Frame Detect Drift and Import Existing Resources

Recognize infrastructure drift, import existing objects with configuration-driven intent, and choose reconciliation without accidentally replacing or abandoning resources.

A manually created test bucket must enter OpenTofu management, while an existing managed firewall rule was changed directly in the cloud console.

Keep the delivery target, declared intent, execution evidence, reliability boundary, and recovery choice separate. Start with observable state and preserve enough context for another operator to reproduce the decision.

Remote object

An existing remote object can predate its OpenTofu resource address and state binding. Within detect drift and import existing resources, this role answers a separate delivery or reliability question and keeps its own evidence.

Inspect the bucket identity and current properties before import. Apply that action to the named service case before widening the rollout, infrastructure scope, or incident response.

Respect this boundary: do not import an object whose ownership or identifier is uncertain. The observable result is specific: the target bucket identity is confirmed outside state.

Resource declaration

Import requires a corresponding resource declaration that describes intended ongoing management. Within detect drift and import existing resources, this role answers a separate delivery or reliability question and keeps its own evidence.

Write the bucket resource with reviewed desired properties. Apply that action to the named service case before widening the rollout, infrastructure scope, or incident response.

Respect this boundary: do not import into an empty placeholder and ignore later differences. The observable result is specific: the configuration expresses the bucket's intended managed state.

Import mapping

A configuration-driven import maps an existing object identity to one resource address through plan and apply. Within detect drift and import existing resources, this role answers a separate delivery or reliability question and keeps its own evidence.

Review the import block and plan before updating state. Apply that action to the named service case before widening the rollout, infrastructure scope, or incident response.

Respect this boundary: do not bind one remote object to multiple active addresses. The observable result is specific: state records the bucket under the intended resource address.

Drift signal

Drift is a difference between declared intent and observed managed infrastructure caused outside the accepted workflow. Within detect drift and import existing resources, this role answers a separate delivery or reliability question and keeps its own evidence.

Refresh and inspect the firewall rule difference in the plan. Apply that action to the named service case before widening the rollout, infrastructure scope, or incident response.

Respect this boundary: do not call every planned change drift when configuration itself changed. The observable result is specific: the plan identifies the exact out-of-band firewall difference.

Reconciliation choice

Reconciliation chooses whether configuration should restore intent or be deliberately updated to accept reality. Within detect drift and import existing resources, this role answers a separate delivery or reliability question and keeps its own evidence.

Confirm ownership and choose one reviewed source of truth for the firewall rule. Apply that action to the named service case before widening the rollout, infrastructure scope, or incident response.

Respect this boundary: do not apply until the intended value is explicitly decided. The observable result is specific: configuration and the remote firewall rule converge on the accepted value.

Apply Detect Drift and Import Existing Resources to One Service Change

Use one bounded delivery decision: A manually created test bucket must enter OpenTofu management, while an existing managed firewall rule was changed directly in the cloud console.

First, inspect the bucket identity and current properties before import. Then, write the bucket resource with reviewed desired properties. Keep both observations attached to the exact revision, environment, or service window.

Next, review the import block and plan before updating state. After that, refresh and inspect the firewall rule difference in the plan. Close the work only after you confirm ownership and choose one reviewed source of truth for the firewall rule.

Recap Before Practice and Prove

Remote object: An existing remote object can predate its OpenTofu resource address and state binding. In this service case, inspect the bucket identity and current properties before import. Preserve the boundary: do not import an object whose ownership or identifier is uncertain.

Resource declaration: Import requires a corresponding resource declaration that describes intended ongoing management. In this service case, write the bucket resource with reviewed desired properties. Preserve the boundary: do not import into an empty placeholder and ignore later differences.

Import mapping: A configuration-driven import maps an existing object identity to one resource address through plan and apply. In this service case, review the import block and plan before updating state. Preserve the boundary: do not bind one remote object to multiple active addresses.

Drift signal: Drift is a difference between declared intent and observed managed infrastructure caused outside the accepted workflow. In this service case, refresh and inspect the firewall rule difference in the plan. Preserve the boundary: do not call every planned change drift when configuration itself changed.

Reconciliation choice: Reconciliation chooses whether configuration should restore intent or be deliberately updated to accept reality. In this service case, confirm ownership and choose one reviewed source of truth for the firewall rule. Preserve the boundary: do not apply until the intended value is explicitly decided.