What is the difference between importing EKS resources into Terraform and reprovisioning them?

Importing connects existing EKS resources to Terraform so teams can manage them declaratively without destroying production systems. Reprovisioning creates new infrastructure from scratch, which can be risky when live workloads already depend on the cluster. Import is usually the safer path when the objective is control, not replacement.

Why This Matters for Security Teams

The practical difference is not just technical, it is operational risk. Importing existing EKS resources into Terraform preserves the live cluster, node groups, IAM bindings, and related dependencies while bringing them under declarative control. Reprovisioning is a replacement strategy, so any drift, hidden dependency, or state mismatch can turn a routine infrastructure change into an outage. This is especially important for NHIs, where unmanaged secrets and service accounts often persist long after the original deployment. NHI Mgmt Group notes that 79% of organisations have experienced secrets leaks, with 77% causing tangible damage, which is why control without disruption matters.

Security teams often underestimate how much identity and access state is already embedded in a running EKS environment. A new cluster can look cleaner on paper, but it also resets trust assumptions, can break workload identity, and may leave old permissions active until cleanup is complete. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces the need to manage system changes in a controlled way, while the Top 10 NHI Issues highlights how quickly secrets and access paths become a hidden attack surface. In practice, many security teams discover the cost of reprovisioning only after application outages or identity failures have already started.

How It Works in Practice

Importing EKS resources means Terraform writes existing cloud objects into state, so future plans describe and manage what is already deployed. That usually includes the cluster, managed node groups, security groups, IAM roles, and add-ons. Reprovisioning, by contrast, creates a fresh control plane and related resources, then asks operators to migrate workloads, identities, networking, and policies across. For clusters that already run production workloads, import is usually the safer first step because it reduces disruption and helps teams surface drift before they change anything.

The operational workflow is straightforward, but it needs discipline. First, inventory the live EKS footprint and identify what Terraform should own versus what should remain external. Next, import resources into state, then run a plan to expose differences between the declared configuration and the actual environment. Only after that should teams decide whether to reconcile drift, refactor modules, or deliberately replace components. The lifecycle thinking in NHI Lifecycle Management Guide is useful here because the same principle applies to infrastructure identity: observe, classify, control, then change. For visibility into what is already embedded in live systems, Ultimate Guide to NHIs is especially relevant.

• Use import when the cluster is already serving workloads and the goal is governance, not replacement.
• Use reprovisioning when the current cluster is irreparably broken, noncompliant, or intentionally being redesigned.
• Validate IAM roles, Kubernetes RBAC, secrets references, and add-on versions before any state move.
• Expect drift in security groups, managed node groups, and addon settings unless they are explicitly reconciled.

These controls tend to break down in tightly coupled environments where applications, CI/CD pipelines, and workload identities all assume specific cluster IDs or endpoint values, because migration then becomes an application portability problem as much as an infrastructure one.

Common Variations and Edge Cases

Tighter change control often increases migration effort, requiring organisations to balance safety against the time needed to normalise the configuration. A common edge case is partial import, where only the cluster is imported but node groups or IAM resources remain unmanaged. That creates a false sense of control because terraform state does not fully reflect the deployed blast radius. Another is when teams treat reprovisioning as a cleanup strategy for drift, which can silently preserve the very access paths they hoped to eliminate.

Best practice is evolving around whether to import everything at once or stage ownership gradually, especially in large EKS estates. There is no universal standard for this yet, but current guidance suggests prioritising resources with the highest operational impact and the clearest ownership first. This aligns with the broader NHI risk pattern documented in Ultimate Guide to NHIs — What are Non-Human Identities, where hidden machine identities and long-lived credentials often outlast the system that created them. Reprovisioning may still be the right answer when architectural change is required, but it should be treated as a migration project, not a terraform import workaround.

Related resources from NHI Mgmt Group

• How should teams govern ECS resources after importing them into Terraform?
• What is the difference between discovering AI agents and controlling them?
• What is the difference between monitoring MCP agents and controlling them?
• What is the difference between automating dependency updates and granting them blind trust?