A platform team must bring several hundred existing compute instances spread across one cloud account under Terraform management. Nobody has an inventory of their IDs, and hand-writing an import block for each is not practical. Using Terraform 1.15 and a provider that supports list resources, which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Here's the trick: you can't import what you can't find. A list block in a .tfquery.hcl file is your search party, and terraform query brings back what it found, ready to drop into import and resource blocks. Plan alone never goes looking for strays.
Full Explanation
Terraform 1.14 added list resources: in a .tfquery.hcl file you declare list blocks for resource types the provider supports, with filters, and the terraform query command asks the provider to return matching existing objects. Adding -generate-config-out tells Terraform to write import blocks and resource blocks for the results, which turns discovery into a bulk import that still goes through normal review, plan and apply. The generated code should be reviewed and refactored like any generated configuration before it is applied. Plan's own -generate-config-out works only for resources already named by import blocks; plan never scans an account for unmanaged objects. Data sources read objects but do not manage them, and terraform state mv relocates managed resources between addresses; it cannot turn a data source into a managed resource. The terraform import command takes one address and one ID per invocation and has no wildcard enumeration. Exam caveat: list resources depend on provider support, so check that the provider implements a list resource for the type before planning this workflow. Operational check: after generating, run terraform plan and confirm that every instance appears as an import with no creates or replacements.