TF-004 Use Terraform outside the core workflow Practice Question
A team wants to import an existing AWS S3 bucket named 'my-bucket' into Terraform state. The resource block is defined as 'aws_s3_bucket.my_bucket'. Which command should be used?
⚠ Common exam trap
The Terraform exam often tests the argument order in `terraform import` — candidates frequently confuse the resource address and the resource ID, mistakenly thinking the ID comes first (as in some cloud CLI tools), but Terraform strictly requires the address before the ID.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
terraform import aws_s3_bucket.my_bucket my-bucket
The correct syntax for `terraform import` is `terraform import <resource_address> <id>`, where the resource address is the Terraform resource block identifier (e.g., `aws_s3_bucket.my_bucket`) and the ID is the actual AWS resource identifier (e.g., the bucket name `my-bucket`). Option C follows this exact order: `terraform import aws_s3_bucket.my_bucket my-bucket`, making it the correct command to import the existing S3 bucket into Terraform state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
terraform import my-bucket aws_s3_bucket.my_bucket
Why it's wrong here
The `terraform import` command requires the target Terraform resource address to be specified first, followed by the ID of the existing infrastructure resource. This command incorrectly reverses that order, attempting to provide the external resource ID (`my-bucket`) before the intended Terraform resource address (`aws_s3_bucket.my_bucket`). Consequently, Terraform cannot correctly parse the command arguments to identify which resource to import into which managed state entry.
- ✗
terraform import 'aws_s3_bucket.my_bucket' 'my-bucket'
Why it's wrong here
While some shell environments might permit quoting arguments like `'aws_s3_bucket.my_bucket'` and `'my-bucket'`, it is generally unnecessary and not the standard practice for `terraform import` when the resource ID does not contain spaces or special characters. Terraform's command-line parser typically handles unquoted arguments correctly in this context. Using quotes adds verbosity without providing a functional benefit for simple identifiers and can occasionally lead to unexpected parsing issues depending on the shell.
- ✓
terraform import aws_s3_bucket.my_bucket my-bucket
Why this is correct
This command correctly follows the `terraform import <ADDRESS> <ID>` syntax, which is essential for bringing existing infrastructure under Terraform management. `aws_s3_bucket.my_bucket` accurately specifies the desired Terraform resource address, indicating it should be managed as an `aws_s3_bucket` resource named `my_bucket` within the configuration. `my-bucket` correctly identifies the exact ID of the pre-existing AWS S3 bucket to be imported into Terraform's state.
- ✗
terraform import aws_s3_bucket.my-bucket my-bucket
Why it's wrong here
The resource address `aws_s3_bucket.my-bucket` is syntactically incorrect because the local name part (`my-bucket`) contains a hyphen. Terraform resource names, which are HCL identifiers, must adhere to specific naming conventions, typically allowing only alphanumeric characters and underscores, not hyphens. Therefore, `my-bucket` is an invalid identifier for the local name of a Terraform resource, preventing the command from correctly identifying the target resource in the configuration.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.