How should teams import existing EKS clusters into Terraform without disrupting production workloads?

Teams should treat import as a state alignment exercise, not a rebuild. The goal is to map live AWS EKS resources into Terraform state, validate the generated configuration, and confirm that planned changes are no-ops before applying anything. That approach reduces drift, avoids unnecessary reprovisioning, and lets operators bring manually created clusters under consistent IaC control.

Why This Matters for Security Teams

Importing an existing EKS cluster into Terraform is a governance exercise with production impact, not a simple tooling step. If the import is handled like a rebuild, Terraform can attempt to reconcile resources that were never meant to change, which can affect node groups, networking, IAM bindings, and add-ons. The practical goal is to align state with reality while preserving live workload behaviour.

That matters because EKS environments often accumulate drift through console changes, scripts, and one-off fixes. NHI Management Group’s Ultimate Guide to NHIs — What are Non-Human Identities shows how often machine identity and access complexity outpaces manual control, and the same pattern appears in cluster operations. For Terraform users, the question is not whether the cluster exists, but whether the imported configuration faithfully represents the current production intent. Current guidance suggests treating the import as a controlled reconciliation, with careful review of every planned diff before any apply.

In practice, many security and platform teams discover destructive drift only after an import plan exposes hidden assumptions that were never documented in the original build.

How It Works in Practice

The safest import workflow starts by inventorying the cluster and all dependent resources that Terraform will need to understand, including VPC components, security groups, IAM roles, EKS control plane settings, managed node groups, and any add-ons. Teams usually import one resource class at a time, then run SPIFFE workload identity specification or cloud-native identity patterns only as a conceptual guide for workload trust, not as a substitute for infrastructure state discipline.

After import, generated or hand-written configuration should be validated against the live object model. The goal is to make the first plan boring: no replacements, no unintended force-new actions, and no surprise deletions. NHI Management Group’s Guide to SPIFFE and SPIRE is useful here because it reinforces a broader principle that applies to infrastructure imports as well: identity and trust must be explicit, observable, and version-controlled. For Terraform, that means capturing cluster state accurately, then tightening configuration only after the live resource has been safely represented.

• Import the EKS control plane first, then node groups, IAM roles, security groups, and add-ons.
• Compare the generated plan against live AWS settings before editing module code.
• Expect some fields to be read-only or provider-managed, and do not force them into drift-free perfection.
• Freeze unrelated changes during the import window to reduce accidental coupling.
• Use a small production-safe test, such as a no-op plan, before moving to any apply.

Where teams often go wrong is assuming Terraform can discover intent from live resources; it can only enforce what is encoded in state and configuration. These controls tend to break down when the cluster was built from many hand-tuned exceptions because the imported state cannot infer which differences are operationally intentional.

Common Variations and Edge Cases

Tighter import discipline often increases short-term effort, requiring organisations to balance safety against the time needed to model messy reality. That tradeoff is real when EKS clusters contain mixed ownership, custom controllers, or add-ons that were installed outside Terraform. Best practice is evolving, but current guidance suggests leaving some provider-managed attributes untouched rather than trying to standardise everything on the first pass.

One edge case is a cluster whose networking or IAM was partially recreated over time. In that situation, Terraform may see resources that appear equivalent but are not identical enough for a clean import. Another common case is managed node groups with autoscaling behaviour, where a strict diff can be misleading if the team does not understand which settings AWS adjusts dynamically. NHI Management Group’s Ultimate Guide to NHIs — Standards is relevant because it highlights the broader issue: controls work best when ownership, lifecycle, and authority boundaries are explicit.

For highly regulated environments, teams should also check whether imported infrastructure state will be used as an audit artefact, because that can change the level of change control required. The safest posture is to treat anything unknown as a live dependency until proven otherwise. That approach preserves production workloads while bringing the cluster under repeatable IaC governance.

Related resources from NHI Mgmt Group

• How should security teams add governance to existing Infrastructure as Code pipelines without disrupting delivery workflows?
• How should security teams remediate Terraform drift without creating new deployment risk?
• How should security teams manage policy deletions in production authorization systems without breaking access control integrity?
• How should security teams roll out passkeys without disrupting existing authentication flows?