How to fix Error: resource address must refer to a resource defined in configuration in Terraform

First, check if the resource is actually defined in your .tf files:

grep -r "resource.*aws_instance.*web" .
grep -r "resource.*aws_s3_bucket.*example" .

If the grep returns results, the resource is defined. If it returns nothing, the resource is missing from your configuration.

Alternatively, use terraform state list to see all currently tracked resources:

terraform state list

This helps you identify the exact resource address format.

If you're importing a resource from a module, verify you're using the correct full path:

Wrong (missing module path):

terraform import aws_instance.example i-1234567890abcdef0

Correct (with module path):

terraform import 'module.vpc.aws_instance.example' i-1234567890abcdef0

The resource must be defined in your module:

module "vpc" {
  source = "./modules/vpc"
}

# Then in modules/vpc/main.tf:
resource "aws_instance" "example" {
  # configuration...
}

For Terraform v0.12 and later, you must include the full module path. Omitting it will only match resources in the root module.

If you want to import an existing cloud resource into Terraform, create a minimal resource block in your .tf files first:

resource "aws_instance" "web" {
  # Leave empty - Terraform will fill in the actual values during import
}

Then run the import command:

terraform import aws_instance.web i-1234567890abcdef0

Terraform will populate the resource block with the current state. However, you'll still need to manually add configuration details like:
- AMI ID
- Instance type
- VPC/subnet settings
- Security groups
- Tags

Make sure the resource block name ("web" in this case) matches the address in your command.

Terraform 1.5+ introduced configuration-driven import, which is safer:

import {
  to = aws_instance.web
  id = "i-1234567890abcdef0"
}

resource "aws_instance" "web" {
  # configuration...
}

Then run:

terraform plan -generate-config-out=generated.tf
terraform apply

Terraform will show you the import operation in the plan before modifying state, making it safer for CI/CD pipelines.

Check that you're using the correct resource type for your provider:

Common AWS mistakes:
- ✗ aws_ec2_instance (does NOT exist)
- ✓ aws_instance
- ✗ aws_security_group_rule_ingress
- ✓ aws_security_group_rule or aws_security_group with inline rules
- ✗ aws_s3_object
- ✓ aws_s3_object (for older versions) or aws_s3_bucket (for newer versions)

Refer to the provider documentation for exact resource names:

# For AWS
terraform providers

Or visit the official registry: https://registry.terraform.io/providers/hashicorp/aws/latest

If your resource uses for_each with special characters, you must escape quotes in the shell:

Wrong (shell expands quotes):

terraform import aws_instance["test"] i-1234567890abcdef0

Correct (single quotes prevent shell expansion):

terraform import 'aws_instance["test"]' i-1234567890abcdef0

Your configuration should have:

resource "aws_instance" "example" {
  for_each = {
    "test" = "i-1234567890abcdef0"
  }
  # configuration...
}

Use single quotes around the entire resource address to prevent shell expansion issues.

After successfully importing or managing resources, verify the address format by listing all tracked resources:

terraform state list

Output example:

aws_instance.web
module.vpc.aws_security_group.main
aws_s3_bucket.logs["us-east-1"]

This shows you the exact format to use in state commands. When using terraform state rm or terraform state mv, copy the address exactly as it appears in the list.