🏗️ Terraform Error: import block config generation failed on plan

Exact Error Message

╷
│ Error: Configuration for import target does not exist
│
│   on imports.tf line 1:
│    1: import {
│
│ The configuration for the given import target aws_instance.web does not
│ exist. All target instances must have an associated configuration to be
│ imported.
│
│ If you wish to automatically generate config for this resource, use the
│ -generate-config-out option within terraform plan. Otherwise, add the
│ resource block manually.
╵

A closely related failure appears when generation is requested but cannot complete:

│ Error: Failed to generate config
│
│ Terraform generated a resource configuration for aws_instance.web but
│ could not write it because a resource block for that address already
│ exists in the configuration.

What It Means

Terraform’s import block (Terraform 1.5+) links an existing real-world object to a resource address in your configuration. Terraform needs a resource block for that address so it knows how to manage it going forward.

You have two options: write the resource block yourself, or ask Terraform to draft one with terraform plan -generate-config-out=<file>. The errors above mean either you provided no resource block and did not request generation, or generation was requested but Terraform could not produce a usable file — most often because a block for that address already exists, or the provider could not read the object.

Common Causes

• You ran a plain terraform plan without -generate-config-out and never wrote the resource block by hand.
• A resource block for the target address already exists, so generation refuses to overwrite it.
• The id in the import block is wrong or malformed for that resource type, so the provider cannot read the object.
• The provider lacks read support for some attributes, producing config that references write-only or computed fields.
• Credentials or region do not match where the object actually lives, so the read returns “not found.”

Diagnostic Commands

Check your import block’s target address and id:

grep -A3 'import {' imports.tf

Confirm no resource block already claims that address:

grep -rn 'resource "aws_instance" "web"' *.tf

Verify the object exists and your credentials can see it (AWS example):

aws ec2 describe-instances --instance-ids i-0abc123def456 --query 'Reservations[].Instances[].State.Name'

Run generation into a fresh file and read the result:

terraform plan -generate-config-out=generated.tf

Step-by-Step Resolution

1. Make sure your import block has the correct address and a valid id:

import {
  to = aws_instance.web
  id = "i-0abc123def456"
}

2. Ensure there is no existing resource "aws_instance" "web" block anywhere — generation writes a new one and will not overwrite. Delete any placeholder block first.

3. Run plan with -generate-config-out pointing at a file that does not yet contain that resource:

terraform plan -generate-config-out=generated.tf

4. Review generated.tf. Terraform emits every attribute it could read, including computed ones you should remove. Trim read-only and defaulted fields, and fix any obviously invalid values:

resource "aws_instance" "web" {
  ami           = "ami-0abcd1234"
  instance_type = "t3.micro"
  subnet_id     = "subnet-0abc123"
  # remove computed attributes like arn, public_ip, private_dns
}

5. If generation fails on a specific provider attribute, remove that attribute from the block and set it explicitly, then re-run. Some providers cannot generate config for write-only inputs.

6. Once the config is clean, run a normal plan and apply to complete the import:

terraform plan
terraform apply

Apply complete! Resources: 1 imported, 0 added, 0 changed, 0 destroyed.

Prevention

• Always pass -generate-config-out when you have not hand-written the resource block; a plain plan cannot import an undeclared address.
• Generate into a dedicated new file, never one that already declares the target resource.
• Validate the id format for each resource type — many providers expect ARNs, composite keys, or region-prefixed ids rather than a bare name.
• Confirm the provider, region, and credentials match the object’s real location before importing.
• Treat generated config as a draft: prune computed attributes and review defaults before committing. The Terraform import prompts can help you turn raw generated HCL into a clean, reviewable resource block.

Related Errors

• Configuration for import target does not exist — the base case: no resource block and no generation flag.
• Cannot import non-existent remote object — the id points to something the provider cannot find.
• Resource already managed by Terraform — the address is already in state.
• Invalid resource instance for import — the target uses count/for_each and needs an indexed address.

Frequently Asked Questions

Why does plan say config does not exist even though I have an import block? The import block alone is not enough — Terraform needs a resource block for the target address, either written by you or generated with -generate-config-out.

Can I generate config for many import blocks at once? Yes. A single terraform plan -generate-config-out=file.tf writes generated blocks for every import target that lacks configuration.

Why did generation fail with ‘a resource block already exists’? Generation will not overwrite an existing declaration. Delete or empty the pre-existing resource block for that address, then re-run generation.

Should I commit the generated file as-is? No — always review it first. Terraform includes computed and read-only attributes that will cause noisy diffs or apply errors if left in. For more import walkthroughs, see the Terraform guides.