# Exercise 3 — Import existing resources and refactor safely (hard)
#
# Scenario: a bucket "petpal-legacy-assets" and an IAM role "legacy-reporting"
# were created by hand. Bring them under Terraform WITHOUT recreating them,
# then rename resources without destroying anything.
#
# STEP 1: add `import` blocks for both resources (bucket id = bucket name,
#         role id = role name).
# STEP 2: run `terraform plan -generate-config-out=generated.tf`, review the
#         generated HCL, move what you keep into this file, and iterate until
#         the plan says "0 to add, 0 to change, 0 to destroy" (apart from the
#         imports themselves).
# STEP 3: rename aws_s3_bucket.legacy to aws_s3_bucket.assets using a `moved`
#         block, and check the plan shows a move, not destroy/create.
# STEP 4: stop managing the IAM role WITHOUT deleting it, using a `removed`
#         block with lifecycle { destroy = false }.
# STEP 5 (comment): why is `terraform state rm` riskier than a removed block in
#         a team setting?

terraform {
  required_version = ">= 1.7"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" {
  region = "eu-west-1"
}

# TODO STEP 1
# import {
#   to = aws_s3_bucket.legacy
#   id = "petpal-legacy-assets"
# }

# TODO STEP 2 (paste the refined resources here)

# TODO STEP 3
# moved {
#   from = aws_s3_bucket.legacy
#   to   = aws_s3_bucket.assets
# }

# TODO STEP 4

# STEP 5 answer:
#

# ---------------------------------------------------------------------------
# CHECKLIST:
# [ ] The first plan shows "2 to import, 0 to add, 0 to change, 0 to destroy".
# [ ] Generated config was cleaned up (no read-only/computed attributes left that
#     cause perpetual diffs).
# [ ] After the moved block, the plan shows "aws_s3_bucket.legacy has moved to
#     aws_s3_bucket.assets" and no replacement.
# [ ] After the removed block, the role is gone from state but still exists in AWS.
# [ ] STEP 5: state rm is an out-of-band, unreviewed state mutation that other
#     people's runs don't see in code; removed blocks are reviewed in PRs and
#     applied consistently.
# ---------------------------------------------------------------------------