How do organisations decide which infrastructure resources should be imported first?

Why This Matters for Security Teams

Import order is not just a Terraform housekeeping decision. It sets the pace for visibility, drift control, and privilege reduction across the environment. If teams start with low-impact resources, they often spend weeks documenting the easy parts while the systems that matter most remain unmanaged. NIST’s Cybersecurity Framework 2.0 emphasises prioritisation and risk-based action, which maps well to infrastructure import planning.

The practical question is where unmanaged state creates the greatest exposure: shared IAM boundaries, internet-facing services, regional control planes, and configuration sources that can affect many downstream workloads. This is also where NHI risk tends to concentrate. NHI Mgmt Group research on the Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which is a strong indicator that control gaps usually sit in the same core systems teams need to import first.

In practice, many security teams discover the real priority only after an access review, outage, or secrets incident has already exposed which resources were carrying the most operational risk.

How It Works in Practice

The best import sequence starts with a short inventory and a risk ranking, not a full estate freeze. Teams typically score resources by blast radius, change frequency, dependency count, and identity sensitivity. Shared services, policy layers, VPC and network primitives, CI/CD components, and central secret stores usually move to the top because they influence many other objects. High-value application stacks come next, especially where manual edits have already created drift.

A practical rule is to import the resources that would be most painful to recreate incorrectly. That often includes IAM roles, security groups, load balancers, DNS zones, KMS keys, clusters, and platform-wide tagging or policy controls. For NHI-heavy environments, it is also wise to import the resources that issue or broker secrets first, because unmanaged credential sources can hide privilege pathways. NHI Mgmt Group’s JetBrains GitHub plugin token exposure and Code Formatting Tools Credential Leaks coverage both illustrate how quickly exposed tokens become an infrastructure problem, not just a code problem.

• Start with resources that have many downstream dependencies.
• Import shared and security-critical primitives before application leaf nodes.
• Prefer resources with stable ownership and clear naming, since those are easier to validate.
• Bundle closely related resources so state relationships remain consistent.

After each import wave, teams should validate drift, confirm ownership, and decide whether the next batch should be defined by business criticality, geographic scope, or identity risk. Current guidance suggests this should be an iterative process rather than a one-time migration plan. These controls tend to break down when resources are heavily hand-managed across multiple accounts or subscriptions because dependency mapping becomes unreliable and imports can easily create false confidence.

Common Variations and Edge Cases

Tighter import sequencing often slows initial delivery, requiring organisations to balance rapid Terraform adoption against the cost of mapping complex legacy estates. That tradeoff is normal, especially in environments with many regional clusters or long-lived exceptions.

There is no universal standard for sequencing every infrastructure import, so teams should adapt the order to architecture and risk. For example, a startup may begin with the production account and its identity boundary, while a regulated enterprise may start with shared network controls and audit logging. If an estate has brittle naming conventions or unmanaged dependencies, importing by product line can be safer than importing by environment.

Another edge case is infrastructure that is already partially codified but inconsistently so. In that situation, best practice is to import the control plane first, then the highest-impact workloads, then the long tail of low-risk resources. The goal is not to make every object declarative on day one, but to reduce unknowns where a mistake would be costly. The NHIMG case study on JetBrains Marketplace AI Plugin Campaign reinforces why teams should treat identity-adjacent tooling and secret-bearing platforms as early import candidates rather than cleanup items.

Where ownership is unclear, or where a resource is created and destroyed by automation every few minutes, current guidance suggests classifying it as ephemeral and excluding it from the first pass unless it anchors a critical platform dependency.

Related resources from NHI Mgmt Group

• How do organisations decide whether to import existing cache resources or recreate them under Terraform?
• Should organisations prioritise external exposure or internal credential governance first?
• How should organisations decide when to use passkeys versus digital identity credentials?
• How do organisations decide whether to prioritise certificate automation before the next validity reduction?