Bring hand-made resources under code

How to do it

Write an import block with the resource's ID and let the tool write a first draft with plan -generate-config-out. Clean the draft, then apply until the plan shows no changes. Pulumi has pulumi import. Set a managed-by tag on every resource through the provider's default tags. A search for resources without it then lists what is still hand-made.

Example

import {
  to = aws_s3_bucket.invoices
  id = "example-shop-invoices"
}

provider "aws" {
  region = "eu-north-1"
  default_tags {
    tags = { managed-by = "opentofu", service = "shop", environment = "production" }
  }
}

tofu plan -generate-config-out=generated.tf
# Resources the code does not manage yet
aws resource-explorer-2 search --query-string '-tag.key:managed-by' --query 'Resources[].Arn'

How to check

After the import, the plan shows no changes. A resource search in production, such as AWS Resource Explorer, finds no taggable resource without the managed-by tag.