how to update terraform state with manual change done on resources

Question

I had provisioned some resources over AWS which includes EC2 instance as well, but then after that we had attached some extra security groups to these instances which now been detected by terraform and it says it'll rollback it as per the configuration file.

Let's say I had the below code which attaches a Security Group to my EC2 instance -

vpc_security_group_ids = ["sg-xxxx"]

but now my problem is how can I update terraform.tfstate file so that it should not detach manually attached security groups.

I can solve it as below:

1. I would refresh terraform state file with terraform refresh command which will update the state file.
2. Then I have to update my terraform configuration file manually with the security group ids that were attached manually.

But that is only feasible for a small kind of setup, what if we have a complex scenario - do we have any other mechanism in Terraform which would detect the drift and update it?

Answer 1

There is no way Terraform will update your source code when detecting a drift on AWS.

The process you mention is right:

1. Report manual changes done in AWS into the Terraform code
2. Do a terraform plan. It will refresh the state and show you if there is still a difference