Azure Import Infrastructure As Code

Azure Import Infrastructure as Code

Convert one Azure discovery scope into reviewed Terraform with zero unintended destruction or updates.

When to invoke

• Import an Azure resource group or selected ARM resources into Terraform.
• Reverse-engineer deployed Azure infrastructure.
• Map Azure dependencies before IaC adoption.
• Diagnose drift after an attempted import.

Prerequisites and context

• Azure CLI and Terraform CLI are installed and authenticated for read-only discovery.
• Registry and Azure Verified Modules sources are reachable.
• A reviewed Terraform backend and ownership boundary are known before state mutation.

Inputs

Parse $ARGUMENTS as exactly one discovery scope; reject missing or ambiguous combinations.

ARM IDs are cloud identifiers, never local file paths. Do not pass them to file-reading tools.

Procedure

1. Confirm one scope, subscription context, target Terraform root, state owner, and approval boundary.
2. Discover resources with the narrowest read-only Azure command and preserve sanitized evidence.
3. Map parent/child relations, network and identity dependencies, cross-resource references, and creation order.
4. Select an Azure Verified Module for each resource type and read its README, required inputs, child-resource ownership, outputs, providers, and pinned version.
5. If no suitable AVM exists, stop and document the gap; do not silently invent a raw-resource design.
6. Generate providers, modules, variables, outputs, and examples with live non-default properties explicit.
7. Run terraform init, then derive import addresses from .terraform/modules/<key>/main*.tf; never guess nested module, count, or for_each addresses.
8. After explicit state-mutation approval, import one resource at a time and verify identity.
9. Run format, validate, and plan. The accepted plan has zero destroys and zero unwanted updates.

Criteria

Output template

## Azure import result

**Status:** READY | IMPORTED | BLOCKED
**Scope:** <subscription/resource group/resource IDs>
**Terraform root:** <path>

| Resource | AVM module/version | Import address | Import | Plan result |
| --- | --- | --- | --- | --- |

### Drift and gaps
- <unmodeled property, unsupported resource, unwanted action, or none>

### Validation
- `terraform fmt`: <result>
- `terraform validate`: <result>
- `terraform plan`: <0 destroys/updates or blocker>

Limits

• Do not read ARM IDs as files or expose sensitive resource payloads.
• Do not import before backend, state ownership, address, and mutation approval are explicit.
• Do not guess AVM child resources or import addresses.
• Do not accept a plan with destruction or unexplained updates.

Related primitives

Quality gate

• Exactly one discovery scope is used.
• Dependencies and live non-default properties are mapped.
• AVM modules and versions are explicit or a gap blocks progress.
• Import addresses come from downloaded module source.
• State mutation had explicit approval.
• Final plan has zero destroys and zero unintended updates.

References

• Azure Verified Modules Terraform index
• Terraform import language