v1.13.2/internal/command/import.go

// Copyright (c) The OpenTofu Authors
// SPDX-License-Identifier: MPL-2.0
// Copyright (c) 2023 HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

package command

import (
	"context"
	"fmt"
	"log"
	"strings"

	"github.com/hashicorp/hcl/v2"
	"github.com/hashicorp/hcl/v2/hclsyntax"
	"github.com/opentofu/opentofu/internal/configs/configload"
	"github.com/opentofu/opentofu/internal/tracing"

	"github.com/opentofu/opentofu/internal/addrs"
	"github.com/opentofu/opentofu/internal/backend"
	"github.com/opentofu/opentofu/internal/command/arguments"
	"github.com/opentofu/opentofu/internal/command/views"
	"github.com/opentofu/opentofu/internal/configs"
	"github.com/opentofu/opentofu/internal/tfdiags"
	"github.com/opentofu/opentofu/internal/tofu"
)

func ImportCommander() Command {
	cmd := Command{
		Name:  "import",
		Short: "Associate existing infrastructure with a OpenTofu resource",
		Long: `Import existing infrastructure into your OpenTofu state.

This will find and import the specified resource into your OpenTofu state, allowing existing infrastructure to come under OpenTofu management without having to be initially created by OpenTofu. The ADDR specified is the address to import the resource to. Please see the documentation online for resource addresses. The ID is a resource-specific ID to identify that resource being imported. Please reference the documentation for the resource type you're importing to determine the ID syntax to use. It typically matches directly to the ID that the provider uses.

This command will not modify your infrastructure, but it will make network requests to inspect parts of your infrastructure relevant to the resource being imported.`,

		DiagsWithNewline: true,
	}

	args := arguments.BindImport(&cmd.CommandLine)
	cmd.Run = func(meta Meta) int {
		return ImportCommand{meta}.Execute(args, views.NewImport(args.View, meta.View))
	}

	return cmd
}

// ImportCommand is a cli.Command implementation that imports resources
// into the OpenTofu state.
type ImportCommand struct {
	Meta
}

func (c *ImportCommand) Run(rawArgs []string) int {
	return RunCommand(ImportCommander(), c.Meta, rawArgs)
}
func (c ImportCommand) Execute(args *arguments.Import, view views.Import) int {
	var diags tfdiags.Diagnostics

	ctx := c.CommandContext()
	ctx, span := tracing.Tracer().Start(ctx, "Import")
	defer span.End()

	if args.ConfigPath == "" {
		// pwd is our default -config flag value
		args.ConfigPath = c.WorkingDir.NormalizePath(c.WorkingDir.RootModuleDir())
	}

	// Parse the provided resource address.
	traversalSrc := []byte(args.ResourceAddress)
	traversal, travDiags := hclsyntax.ParseTraversalAbs(traversalSrc, "<import-address>", hcl.Pos{Line: 1, Column: 1})
	diags = diags.Append(travDiags)
	if travDiags.HasErrors() {
		// NOTE: The call to Loader.ForceFileSource works well with the view.Diagnostics too since the view is
		// configured in [Meta.configLoader] with a callback to get the sources when it prints the diagnostics.
		c.configLoader().ForceFileSource("<import-address>", traversalSrc) // so we can include a source snippet
		view.Diagnostics(diags)
		view.InvalidAddressReference()
		return 1
	}
	addr, addrDiags := addrs.ParseAbsResourceInstance(traversal)
	diags = diags.Append(addrDiags)
	if addrDiags.HasErrors() {
		// NOTE: The call to Loader.ForceFileSource works well with the view.Diagnostics too since the view is
		// configured in [Meta.configLoader] with a callback to get the sources when it prints the diagnostics.
		c.configLoader().ForceFileSource("<import-address>", traversalSrc) // so we can include a source snippet
		view.Diagnostics(diags)
		view.InvalidAddressReference()
		return 1
	}

	if addr.Resource.Resource.Mode != addrs.ManagedResourceMode {
		var what string
		switch addr.Resource.Resource.Mode {
		case addrs.DataResourceMode:
			what = "a data resource"
		case addrs.EphemeralResourceMode:
			what = "an ephemeral resource"
		default:
			what = "a resource type"
		}
		diags = diags.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Invalid target resource address",
			fmt.Sprintf("A managed resource address is required. Importing into %s is not allowed.", what),
		))
		view.Diagnostics(diags)
		return 1
	}

	if !c.configLoader().IsConfigDir(args.ConfigPath) {
		diags = diags.Append(&hcl.Diagnostic{
			Severity: hcl.DiagError,
			Summary:  "No OpenTofu configuration files",
			Detail: fmt.Sprintf(
				"The directory %s does not contain any OpenTofu configuration files (.tf or .tf.json). To specify a different configuration directory, use the -config=\"...\" command line option.",
				args.ConfigPath,
			),
		})
		view.Diagnostics(diags)
		return 1
	}

	// Load the full config, so we can verify that the target resource is
	// already configured.
	config, configDiags := c.loadConfig(ctx, args.ConfigPath)
	diags = diags.Append(configDiags)
	if configDiags.HasErrors() {
		view.Diagnostics(diags)
		return 1
	}

	// Load the encryption configuration
	enc, encDiags := c.EncryptionFromPath(ctx, args.ConfigPath)
	diags = diags.Append(encDiags)
	if encDiags.HasErrors() {
		view.Diagnostics(diags)
		return 1
	}

	// Verify that the given address points to something that exists in config.
	// This is to reduce the risk that a typo in the resource address will
	// import something that OpenTofu will want to immediately destroy on
	// the next plan, and generally acts as a reassurance of user intent.
	targetConfig := config.DescendentForInstance(addr.Module)
	if targetConfig == nil {
		modulePath := addr.Module.String()
		diags = diags.Append(&hcl.Diagnostic{
			Severity: hcl.DiagError,
			Summary:  "Import to non-existent module",
			Detail: fmt.Sprintf(
				"%s is not defined in the configuration. Please add configuration for this module before importing into it.",
				modulePath,
			),
		})
		view.Diagnostics(diags)
		return 1
	}
	targetMod := targetConfig.Module
	rcs := targetMod.ManagedResources
	var rc *configs.Resource
	resourceRelAddr := addr.Resource.Resource
	for _, thisRc := range rcs {
		if resourceRelAddr.Type == thisRc.Type && resourceRelAddr.Name == thisRc.Name {
			rc = thisRc
			break
		}
	}
	if rc == nil {
		modulePath := addr.Module.String()
		if modulePath == "" {
			modulePath = "the root module"
		}

		view.Diagnostics(diags)
		view.MissingResourceConfiguration(addr, modulePath, resourceRelAddr.Type, resourceRelAddr.Name)
		return 1
	}

	// Check for user-supplied plugin path
	var err error
	if c.pluginPath, err = c.loadPluginPath(); err != nil {
		view.Diagnostics(tfdiags.Diagnostics{}.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Error loading plugin path",
			err.Error(),
		)))
		return 1
	}

	// Load the backend
	b, backendDiags := c.Backend(ctx, &BackendOpts{
		Config: config.Module.Backend,
		View:   view.Backend(),
	}, enc.State())
	diags = diags.Append(backendDiags)
	if backendDiags.HasErrors() {
		view.Diagnostics(diags)
		return 1
	}

	// We require a backend.Local to build a context.
	// This isn't necessarily a "local.Local" backend, which provides local
	// operations, however that is the only current implementation. A
	// "local.Local" backend also doesn't necessarily provide local state, as
	// that may be delegated to a "remotestate.Backend".
	local, ok := b.(backend.Local)
	if !ok {
		view.UnsupportedLocalOp()
		return 1
	}

	// Build the operation
	opReq := c.Operation(ctx, b, view.Backend(), enc)
	opReq.ConfigDir = args.ConfigPath
	opReq.ConfigLoader, err = configload.Initialise(c.configLoader())
	if err != nil {
		diags = diags.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Error loading the configuration",
			err.Error(),
		))
		view.Diagnostics(diags)
		return 1
	}
	opReq.Hooks = view.Hooks()
	{
		// Setup required variables/call for operation (usually done in Meta.RunOperation)
		var moreDiags, callDiags tfdiags.Diagnostics
		opReq.Variables, moreDiags = c.collectVariableValues()
		opReq.RootCall, callDiags = c.rootModuleCall(ctx, opReq.ConfigDir)
		diags = diags.Append(moreDiags).Append(callDiags)
		if moreDiags.HasErrors() {
			view.Diagnostics(diags)
			return 1
		}
	}
	opReq.View = view.Operation()

	// Check remote OpenTofu version is compatible
	remoteVersionDiags := c.remoteVersionCheck(b, opReq.Workspace)
	diags = diags.Append(remoteVersionDiags)
	view.Diagnostics(diags)
	if diags.HasErrors() {
		return 1
	}

	// Get the context
	stopCtx, cancel := c.InterruptibleContext(ctx)
	defer cancel()
	lr, state, ctxDiags := local.LocalRun(ctx, stopCtx, opReq)
	diags = diags.Append(ctxDiags)
	if ctxDiags.HasErrors() {
		view.Diagnostics(diags)
		return 1
	}

	// Successfully creating the context can result in a lock, so ensure we release it
	defer func() {
		diags := opReq.StateLocker.Unlock()
		if diags.HasErrors() {
			view.Diagnostics(diags)
		}
	}()

	// Perform the import. Note that as you can see it is possible for this
	// API to import more than one resource at once. For now, we only allow
	// one while we stabilize this feature.
	newState, importDiags := lr.Core.Import(ctx, lr.Config, lr.InputState, &tofu.ImportOpts{
		Targets: []*tofu.ImportTarget{
			{
				CommandLineImportTarget: &tofu.CommandLineImportTarget{
					Addr: addr,
					ID:   args.ResourceID,
				},
			},
		},

		// The LocalRun idea is designed around our primary operations, so
		// the input variables end up represented as plan options even though
		// this particular operation isn't really a plan.
		SetVariables: lr.PlanOpts.SetVariables,
	})
	diags = diags.Append(importDiags)
	if diags.HasErrors() {
		view.Diagnostics(diags)
		return 1
	}

	// Get schemas, if possible, before writing state
	var schemas *tofu.Schemas
	if isCloudMode(b) {
		var schemaDiags tfdiags.Diagnostics
		schemas, schemaDiags = c.MaybeGetSchemas(ctx, newState, nil)
		diags = diags.Append(schemaDiags)
	}

	// Persist the final state
	log.Printf("[INFO] Writing state output to: %s", c.Meta.StateOutPath())
	if err := state.WriteState(newState); err != nil {
		view.Diagnostics(tfdiags.Diagnostics{}.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Error writing state file",
			err.Error(),
		)))
		return 1
	}
	if err := state.PersistState(context.TODO(), schemas); err != nil {
		view.Diagnostics(tfdiags.Diagnostics{}.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Error persisting the state file",
			err.Error(),
		)))
		return 1
	}

	view.Success()
	view.Diagnostics(diags)
	if diags.HasErrors() {
		return 1
	}

	return 0
}

func (c *ImportCommand) Help() string {
	helpText := `
Usage: tofu [global options] import [options] ADDR ID

  Import existing infrastructure into your OpenTofu state.

  This will find and import the specified resource into your OpenTofu
  state, allowing existing infrastructure to come under OpenTofu
  management without having to be initially created by OpenTofu.

  The ADDR specified is the address to import the resource to. Please
  see the documentation online for resource addresses. The ID is a
  resource-specific ID to identify that resource being imported. Please
  reference the documentation for the resource type you're importing to
  determine the ID syntax to use. It typically matches directly to the ID
  that the provider uses.

  This command will not modify your infrastructure, but it will make
  network requests to inspect parts of your infrastructure relevant to
  the resource being imported.

Options:

  -compact-warnings       If OpenTofu produces any warnings that are not
                          accompanied by errors, show them in a more compact
                          form that includes only the summary messages.

  -consolidate-warnings   If OpenTofu produces any warnings, no consolidation
                          will be performed. All locations, for all warnings
                          will be listed. Enabled by default.

  -consolidate-errors     If OpenTofu produces any errors, no consolidation
                          will be performed. All locations, for all errors
                          will be listed. Disabled by default

  -config=path            Path to a directory of OpenTofu configuration files
                          to use to configure the provider. Defaults to pwd.
                          If no config files are present, they must be provided
                          via the input prompts or env vars.

  -input=false            Disable interactive input prompts.

  -lock=false             Don't hold a state lock during the operation. This is
                          dangerous if others might concurrently run commands
                          against the same workspace.

  -lock-timeout=0s        Duration to retry a state lock.

  -no-color               If specified, output won't contain any color.

  -var 'foo=bar'          Set a variable in the OpenTofu configuration. This
                          flag can be set multiple times. This is only useful
                          with the "-config" flag.

  -var-file=foo           Set variables in the OpenTofu configuration from
                          a file. If "terraform.tfvars" or any ".auto.tfvars"
                          files are present, they will be automatically loaded.

  -ignore-remote-version  A rare option used for the remote backend only. See
                          the remote backend documentation for more information.

    
  -json                   The output of the command is printed in json format.

  -json-into=out.json     Produce the same output as -json, but sent directly
                          to the given file. This allows automation to preserve
                          the original human-readable output streams, while
                          capturing more detailed logs for machine analysis.

  -state, state-out, and -backup are legacy options supported for the local
  backend only. For more information, see the local backend's documentation.

`
	return strings.TrimSpace(helpText)
}

func (c *ImportCommand) Synopsis() string {
	return "Associate existing infrastructure with a OpenTofu resource"
}