Teams should first inventory unmanaged resources, group related assets into importable stacks, and validate the generated code against current state before applying changes. The goal is to reduce manual drift while preserving control boundaries, ownership, and auditability. A phased import approach works best when environments are large, mixed, or already accumulated years of configuration sprawl.
Why This Matters for Security Teams
Moving legacy cloud infrastructure into Terraform is not a syntax exercise. It is a governance event. Once unmanaged resources are imported, every hidden dependency, exception, and permission boundary becomes visible, and teams have to decide what is standardised, what is exempt, and what must be retired. That makes the migration a control-plane problem as much as an infrastructure problem.
Security teams often underestimate how much drift has accumulated outside code. Imported state can expose orphaned resources, overbroad roles, and undocumented ownership gaps that were tolerated because they were invisible. The Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because the same lifecycle discipline applies to infrastructure identities, secrets, and access paths that Terraform will begin managing as code. Aligning the migration with the NIST Cybersecurity Framework 2.0 also helps teams frame the work as asset governance, change control, and continuous monitoring rather than one-time import work.
In the 2024 Non-Human Identity Security Report, only 19.6% of security professionals expressed strong confidence in their organisation’s ability to securely manage non-human workload identities, which is a useful warning sign for Terraform at scale because infrastructure state and workload identity frequently intersect. In practice, many security teams discover the real control gaps only after the first import has already surfaced years of untracked drift.
How It Works in Practice
The safest pattern is phased import with governance built in from the start. Begin by inventorying unmanaged infrastructure, then cluster resources into stacks that match ownership, blast radius, and lifecycle, not just technical similarity. Each stack should have a clear accountable owner, a review path, and a rollback plan before import begins. That prevents Terraform from becoming a single monolithic reconciliation exercise that nobody can safely approve.
During import, teams should compare generated configuration against live state and current intent. This is where policy checks matter. Use code review, static validation, and policy-as-code to detect differences in tags, encryption, network exposure, instance profiles, and secret references before any apply operation. The goal is not to mirror everything exactly. The goal is to decide which settings are now codified, which are intentionally left external, and which must be remediated before the resource can be considered governed.
For cloud estates with access-heavy services, Terraform migration should also account for identity and secrets management. Imported resources often depend on credentials or service-linked roles that were created outside formal workflows. That is where NHI governance becomes critical. The same lifecycle and audit perspective described in the Ultimate Guide to NHIs — Regulatory and Audit Perspectives helps teams keep evidence, ownership, and rotation requirements aligned while code is being normalised. NIST controls such as NIST SP 800-53 Rev 5 Security and Privacy Controls are especially relevant for change control, access enforcement, and audit logging.
- Import only resources that have a defined owner and business purpose.
- Validate generated code against live state before any merge or apply.
- Separate stacks by environment and control boundary, not by convenience.
- Treat service accounts, tokens, and attached roles as part of the migration scope.
- Require evidence for exceptions so drift does not return as “temporary” config.
These controls tend to break down when teams attempt bulk import across shared accounts with intertwined dependencies, because ownership, approval, and blast radius cannot be cleanly isolated.
Common Variations and Edge Cases
Tighter Terraform governance often increases short-term migration overhead, requiring organisations to balance standardisation against delivery pressure. That tradeoff is especially visible in legacy estates where some resources cannot be cleanly imported without refactoring, recreation, or temporary coexistence with manual operations. Best practice is evolving here, and there is no universal standard for forcing every resource into code on day one.
Some edge cases deserve special handling. Databases with fragile maintenance windows may need import-only treatment before any code normalisation. Shared networking components can require separate stacks to avoid accidental cross-team churn. Managed services with provider-generated defaults often need explicit suppression or documentation so Terraform does not keep trying to revert acceptable platform behaviour. Secrets and workload credentials should be reviewed as part of the migration, not after, because imported infrastructure can inherit long-lived access paths that are already out of policy.
For organisations trying to mature beyond ad hoc imports, the Top 10 NHI Issues reinforces a core lesson: governance fails when access, ownership, and lifecycle are handled separately. Imported infrastructure should be treated as a governed asset set with audit trails, not merely as code that compiles.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Imported infra often exposes unmanaged secrets and service identities. |
| NIST CSF 2.0 | ID.AM-1 | Terraform import starts with accurate asset inventory and ownership. |
| NIST SP 800-63 | Workload credentials and service accounts need strong identity assurance. | |
| NIST AI RMF | Migration governance needs accountable, risk-based decision making. |
Treat non-human credentials as governed identities with issuance, rotation, and revocation rules.
Related resources from NHI Mgmt Group
- How should security teams govern infrastructure access when moving enterprise applications to Oracle Cloud Infrastructure?
- How should security teams govern Terraform module versions in large infrastructure estates?
- How should financial services teams enforce infrastructure governance across Terraform changes in regulated cloud environments?
- How should security teams prevent duplicate Terraform resource definitions from breaking infrastructure changes at scale?
