How can I safely bring existing AWS infrastructure under Terraform management?

Use Terraform import, preferably with import blocks for a migration this large. Since importing dozens of resources manually would be tedious, inventory the resources with the AWS CLI and generate the import blocks or commands with a script. Import by logical component instead of all at once—such as networking, EKS, DNS, and load balancers. Then inspect the imported state and write the matching Terraform configuration. Importing state does not automatically create clean production-ready HCL.

For a large environment, automation can help with discovery: use the AWS CLI to collect resource IDs and attributes, then generate starter HCL and import commands. Treat the generated code as a draft that needs review. Pay close attention to Route 53 zone IDs and record types, load-balancer listeners and target groups, and AWS defaults that may appear in state but do not need to be explicitly configured. Never apply the first plan blindly against production—review it carefully and make sure no destructive actions are proposed.

The safest workflow is: inventory the existing infrastructure, write the Terraform resources or modules, import the resources, inspect them with terraform show or terraform state show, and repeatedly run terraform plan until there are no unexpected changes. Ideally, the first clean plan should show zero resources to add, change, or destroy. Migrate incrementally and validate each component before moving on. Be especially careful with EKS, VPC networking, load balancers, and Route 53 records because small configuration differences can cause replacements or unwanted updates. Test the process in a non-production environment or with a representative subset first, and use separate state boundaries where that makes operational sense.