🧱 Pulumi Error: 'inputs to import do not match the existing resource'

Exact Error Message

error: inputs to import do not match the existing resource; importing this resource
    will fail unless the following inputs are updated to match the existing resource

    - aws:ec2/instance:Instance (web):
        - instanceType: [want=t3.small] [actual=t3.medium]
        - tags["Env"]:   [want=<null>]  [actual="prod"]

error: preview failed

You may also see this after pulumi import aws:ec2/instance:Instance web i-0abc123 or during pulumi up when an existing resource is adopted via an import option. The bracketed want/actual pairs are the exact drift.

What It Means

pulumi import brings an already-existing cloud resource under Pulumi management. To do that safely, Pulumi reads the live resource, then compares its current state against the inputs declared in your program. If any managed input differs, Pulumi refuses to import — because applying afterwards would immediately mutate the real resource to match your (possibly wrong) code.

The want value is what your program declares; the actual value is what exists in the cloud. The fix is almost never to change the cloud resource — it is to make your program’s inputs match reality so the import is a no-op, and only then evolve the resource on purpose.

Common Causes

• Your program declares a different value for an attribute (instance type, size, name) than the live resource has.
• A tag, label, or property exists on the real resource but is absent from your code (or vice versa).
• Generated import code was hand-edited and drifted from the actual resource state.
• Default values in the SDK differ from how the resource was originally created (e.g. in the console).
• The wrong resource ID was supplied, so Pulumi is comparing against a different object than intended.

Diagnostic Commands

Inspect the live resource so you know the true values to match. For AWS EC2:

aws ec2 describe-instances --instance-ids i-0abc123 \
  --query "Reservations[].Instances[].{Type:InstanceType,Tags:Tags}"

Let Pulumi generate a correct scaffold from the live resource — this writes matching code you can compare against:

pulumi import aws:ec2/instance:Instance web i-0abc123 --generate-code

Run a preview to see the precise want/actual differences without committing anything:

pulumi preview --logtostderr -v=9 2>pulumi.log

Step-by-Step Resolution

1. Read every want/actual pair in the error. Each line is a specific input you must reconcile.

2. Fetch the resource’s real configuration from the cloud provider (see the diagnostic above) so you have authoritative values.

3. Edit your program so each declared input matches the actual value. For the example error, set the instance type and add the missing tag:

web = aws.ec2.Instance(
    "web",
    instance_type="t3.medium",   # match actual, not t3.small
    tags={"Env": "prod"},        # add the tag the live resource has
    # ...other args to match the live resource
)

4. Prefer letting Pulumi generate the scaffold and copy the exact inputs it produces, which avoids guessing defaults:

pulumi import aws:ec2/instance:Instance web i-0abc123 --generate-code

5. Re-run the import (or pulumi up if you use the import resource option). It should now report no diff on the adopted resource:

pulumi import aws:ec2/instance:Instance web i-0abc123

     Type                      Name  Plan
 =   aws:ec2/instance:Instance web   import
Resources:
    = 1 imported

6. Once imported cleanly, remove the import option/ID and run a normal preview to confirm zero changes before making any intentional edits:

pulumi preview

Prevention

• Always start an import with --generate-code and adopt the generated inputs rather than writing them from memory.
• Import first, confirm a zero-diff preview, and only then change attributes on purpose in a separate step.
• Read the live resource with the provider CLI before importing so you know the exact values, including defaults set outside Pulumi.
• Import one resource at a time so mismatches are easy to attribute and fix.
• Keep tags/labels in code identical to what exists in the cloud to avoid surprise diffs on the first apply.

Related Errors

• resource '<id>' does not exist — the supplied ID is wrong or the resource was deleted, a different import failure.
• duplicate resource URN — you are importing a resource under a name already used in the stack.
• a resource with this URN already exists — the resource is already managed and does not need importing.
• preview failed — the generic wrapper this mismatch surfaces under; the want/actual block is the real detail.

Frequently Asked Questions

Should I change the cloud resource to match my code? No — align your code to the live resource so the import is a no-op, then change the resource intentionally in a later, reviewed apply.

What do want and actual mean? want is the value your program declares and actual is the value on the live resource; import fails until every managed input’s want equals its actual.

Is there a way to avoid hand-writing the inputs? Yes — run pulumi import ... --generate-code to have Pulumi emit code that already matches the resource, then paste it into your program.

Why does a diff appear on a tag I did not set? The live resource carries tags applied outside Pulumi; add them to your code (or manage them deliberately) so the inputs match. For prompts that help you reconcile import drift attribute by attribute, see the Pulumi prompt library.

Where can I find more import guides? See the full Pulumi guides for import, adoption, and drift-reconciliation scenarios.