Inherited Infrastructure: Audit, Import, and Reconcile.

You're bringing a Bengaluru B2B e-commerce marketplace's infrastructure under Terraform management without disrupting 100,000 daily orders. Ananya, the senior engineering manager who recently inherited it, has three years of hyper-growth to map: some resources in Terraform, some created through the console during past incidents, some in CloudFormation from a team that left.

The discipline skills: auditing actual AWS resources against Terraform state; terraform import one resource at a time; reconciling AI-generated HCL against real configuration through iterative plans; fixing a broken state backend with S3 versioning and DynamoDB locking; workspace isolation for dev and staging; drift diagnosis where "fixing" the diff might undo a production fix; one routine maintenance task inside a defined window; a managed-vs-self-hosted trade-off you can defend in rupees and operational hours.

The AI-direction lesson is that AI's worst habits are now invisible. Through P1-P8 you could catch AI's mistakes by reading the output carefully -- a wildcard security group, a health check that returned 200 for anything, a cost model that ignored peaks. Here the same reading discipline won't save you. AI generates HCL for an imported resource that looks clean, but the next terraform plan shows diffs because the code doesn't match reality. AI proposes terraform apply to "correct" drift without asking whether the drift was keeping production running. AI recommends RDS for every database workload. The verification technique is new: compare state against the AWS console, read plan diffs against what you know to be load-bearing, and challenge AI's reconciliation defaults.

A new directing register surfaces here too. When you don't know whether RDS or self-managed PostgreSQL is right for the dev database, that uncertainty is a professional opening, not a gap to hide. You direct AI to structure the evaluation rather than asking it for an answer.

Your Role

You're the cloud engineer Ananya brings in because she has the plan and the experience -- she has done this before at a previous company -- but she does not have enough hands. She needs an ally who understands the methodology (import one resource at a time, reconcile HCL against reality, verify before apply) and can execute without her watching every step.

Scaffolding thins at the same time the terrain changes. The brief is deliberately ambiguous: Ananya's email lists five requirements but does not name the specific resources at risk, does not prescribe the import order, does not specify the state backend design, and does not tell you which drift to accept or which service to evaluate. You decide those, propose your sequencing, and explain your reasoning back to her.

With AI, the collaborative register continues but sharpens. You bring the context AI can't infer -- the ₹2 crore that moves through the payment Lambda daily, which drift is load-bearing, which EC2 resize was emergency response, which trade-offs matter for Ananya's leadership conversations. You verify AI's output against reality, not against AI's own confidence.

What's New

Last time in Toronto you built staging, a gated pipeline, SLOs tied to enterprise contracts, and a cost model that accounted for Marcus's 2am batch jobs. Everything was greenfield -- clean resources, clean pipelines, clean monitoring. You left Marcus with safety mechanisms whose depth you specified.

This time is the inflection. You are not building -- you are inheriting. The plan still runs, but it runs against Terraform state that may not match reality. A plan "correction" could break production. You're the next engineer into infrastructure someone else made under time pressure, and most of the job for most of your career is this.

The hard part: the failure modes are subtle. A bulk import with mismatched HCL can trigger forces-replacement on a running production resource. An AI-proposed drift fix can revert an incident fix. A state bucket without versioning or locking can corrupt during concurrent apply. There's no checklist that catches these -- only the discipline of reading the plan against reality, importing one at a time, and treating every diff as either an intentional change or a reconciliation artifact you have to resolve.

Tools

• Claude Code -- directing audit scripts, Terraform for the state backend, HCL for imported resources, drift diagnosis, the certificate renewal, and the managed-vs-self-hosted evaluation. Meta-prompting surfaces for the first time.
• Terraform CLI -- terraform import enters the track here, along with terraform state list, terraform state show, and workspace commands (workspace new, workspace select)
• AWS CLI v2 -- listing actual resources across services for the audit
• AWS Console -- visual archaeology; verifying state against what actually exists, reading change history on specific resources
• S3 and DynamoDB -- the state backend (versioning enabled on the bucket, lock table in DynamoDB)
• AWS Cost Explorer -- 90-day history to identify waste in inherited spend and to frame the managed-vs-self-hosted comparison
• AWS Certificate Manager -- new here; the expiring TLS certificate in the routine maintenance unit
• tflint, checkov -- continuing; checkov gains new relevance against imported resources that may carry pre-existing security issues
• Git and GitHub, VS Code + Terraform extension, Infracost, Grafana -- carrying forward

Everything you've used before. The unit where terraform import first appears walks through the command and its behavior.

Materials

In the project folder:

• Ananya's forwarded email chain (first-contact.md) -- her message to her VP listing five requirements, with older exchanges between Ananya and the departed engineer underneath. Read down the chain.
• Partial Terraform repository (terraform-existing/) -- the current state of IaC coverage at BazaarGrid: missing resources, inconsistent naming, hardcoded values, a commented-out backend configuration
• AWS sandbox description (aws-sandbox-description.md) -- what actually exists in the account, including resources not in Terraform
• Cost Explorer 90-day snapshot (cost-explorer-90day.csv) -- the first read of the bill
• CLAUDE-reference.md -- reference exemplar; structure only, you write your own CLAUDE.md for the inheritance
• Managed-vs-self-hosted evaluation template -- structure only; you populate it

No inventory spreadsheet, no import order, no state backend design, no workspace layout, no drift-diagnosis template, no certificate renewal plan, no managed-vs-self-hosted answer, and no handoff document is provided. You produce all of them.