A workspace runs Terraform 1.15, and a recent provider release adds resource identity support to a resource type whose import IDs are long composite strings that engineers keep getting wrong. The team wants its import blocks to use identity instead. How should the import blocks change?
Select an answer to reveal the explanation.
Short Explanation
It's like swapping a cryptic account number for name, branch and sort code: same object, but much harder to fumble. The catch is that it's either-or. You use id or identity in an import block, never both, and the keys come from the provider, not from you.
Full Explanation
From Terraform 1.12, an import block can identify the remote object with an identity argument instead of id. Identity is an object of key-value pairs, and the keys and values are specific to the resource type and defined by the provider's resource identity schema, so the provider documentation lists exactly which attributes to supply. That replaces hand-assembled composite strings with named fields that are easier to read and validate. The two arguments are mutually exclusive: an import block that sets both id and identity is rejected, so there is no fallback behaviour. Identity belongs in the import block, not in a resource lifecycle block; lifecycle rules control creation, update and destruction behaviour and have no identity setting. Identity values are not arbitrary tags, and Terraform does not search the account for matching tags; the provider uses the identity fields to locate exactly one object. Exam caveat: identity works only for resource types whose provider version implements resource identity, so older provider versions still require id. Operational check: after switching, run terraform plan and confirm each object shows as an import with no create or replace action.