Import, refactor and debug existing infrastructure

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Resources importeren, state bekijken, uitgebreide logs

Import existing resources

An import block brings an existing resource under Terraform's control. With -generate-config-out, Terraform even writes the resource code for you.

import.tf

import {
  to = azurerm_resource_group.legacy
  id = "/subscriptions/SUB_ID/resourceGroups/rg-legacy"
}

$terraform plan -generate-config-out=generated.tf
$terraform apply
$terraform import azurerm_resource_group.legacy /subscriptions/SUB_ID/resourceGroups/rg-legacy

Method	Notes
`import` block	Reviewed in a plan, works in CI, can generate config — the modern way
`terraform import` command	Old way: changes state at once, you write the code yourself

Onthoud

After an import, run plan until it shows no changes — then the code matches reality.

10.2

Inspect the state with the CLI

The state commands read and change state entries safely.

$terraform state list
$terraform state list module.network
$terraform state show 'azurerm_subnet.this["web"]'
$terraform state mv azurerm_subnet.web 'azurerm_subnet.this["web"]'
$terraform state rm azurerm_resource_group.old
$terraform state pull | jq '.resources | length'

Command	Does
`state list`	All resource addresses
`state show ADDR`	All attributes of one resource
`state mv OLD NEW`	Rename / move an entry (no destroy)
`state rm ADDR`	Forget a resource; it stays in the cloud
`state pull` / `push`	Download / upload the raw state (careful!)

10.3

Refactor with moved and removed blocks

Instead of state commands, write the change into the code — it is reviewed and works for every environment.

refactor.tf

moved {
  from = azurerm_subnet.web
  to   = azurerm_subnet.this["web"]
}
 
moved {
  from = azurerm_virtual_network.app
  to   = module.network.azurerm_virtual_network.this
}
 
removed {
  from = azurerm_resource_group.old
  lifecycle {
    destroy = false
  }
}

Examentip

moved = new address, same object, nothing destroyed. removed with destroy = false = stop managing it, keep it in the cloud.

10.4

Turn on verbose logging

TF_LOG prints Terraform's internal logs — API calls, provider errors, timing.

$TF_LOG=DEBUG terraform plan 2> debug.log
$export TF_LOG=TRACE TF_LOG_PATH=./terraform.log
$TF_LOG_PROVIDER=DEBUG terraform apply
$unset TF_LOG TF_LOG_PATH

Variable	Meaning
`TF_LOG`	Level: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, `OFF`
`TF_LOG_CORE` / `TF_LOG_PROVIDER`	Only Terraform core / only providers
`TF_LOG_PATH`	Write the log to a file

Let op

TRACE logs can contain secrets and tokens. Delete them after use, never attach them to a public issue.

Alle commando's in dit hoofdstuk