feat(import): support import blocks inside child modules

.changes/v1.16/NEW FEATURES-20260410-085729.yaml

@@ -0,0 +1,5 @@
+kind: NEW FEATURES
+body: feat(import): add support for import blocks inside modules
+time: 2026-04-10T08:57:29.804462-04:00
+custom:
+    Issue: "38352"

internal/configs/config_build.go

@@ -362,15 +362,6 @@ func loadModule(root *Config, req *ModuleRequest, walker ModuleWalker) (*Config,
 		})
 	}
 
-	if len(mod.Import) > 0 {
-		diags = diags.Append(&hcl.Diagnostic{
-			Severity: hcl.DiagError,
-			Summary:  "Invalid import configuration",
-			Detail:   fmt.Sprintf("An import block was detected in %q. Import blocks are only allowed in the root module.", cfg.Path),
-			Subject:  mod.Import[0].DeclRange.Ptr(),
-		})
-	}
-
 	if len(mod.ListResources) > 0 {
 		first := slices.Collect(maps.Values(mod.ListResources))[0]
 		diags = diags.Append(&hcl.Diagnostic{

internal/configs/config_build_test.go

@@ -5,7 +5,7 @@ package configs
 
 import (
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path"
 	"path/filepath"
 	"reflect"
@@ -214,7 +214,7 @@ func TestBuildConfigChildModule_CloudBlock(t *testing.T) {
 
 func TestBuildConfigInvalidModules(t *testing.T) {
 	testDir := "testdata/config-diagnostics"
-	dirs, err := ioutil.ReadDir(testDir)
+	dirs, err := os.ReadDir(testDir)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -261,8 +261,8 @@ func TestBuildConfigInvalidModules(t *testing.T) {
 			// expected location in the source, but is not required.
 			// The literal characters `\n` are replaced with newlines, but
 			// otherwise the string is unchanged.
-			expectedErrs := readDiags(ioutil.ReadFile(filepath.Join(testDir, name, "errors")))
-			expectedWarnings := readDiags(ioutil.ReadFile(filepath.Join(testDir, name, "warnings")))
+			expectedErrs := readDiags(os.ReadFile(filepath.Join(testDir, name, "errors")))
+			expectedWarnings := readDiags(os.ReadFile(filepath.Join(testDir, name, "warnings")))
 
 			_, buildDiags := BuildConfig(mod, ModuleWalkerFunc(
 				func(req *ModuleRequest) (*Module, *version.Version, hcl.Diagnostics) {

internal/configs/config_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/hashicorp/terraform/internal/addrs"
 	"github.com/hashicorp/terraform/internal/depsfile"
 	"github.com/hashicorp/terraform/internal/getproviders/providerreqs"
-
 	_ "github.com/hashicorp/terraform/internal/logging"
 )
 
@@ -29,7 +28,7 @@ func TestConfigProviderTypes(t *testing.T) {
 		t.Fatal("expected empty result from empty config")
 	}
 
-	cfg, diags := testModuleFromFileWithExperiments("testdata/valid-files/providers-explicit-implied.tf")
+	cfg, diags := testModuleCfgFromFileWithExperiments("testdata/valid-files/providers-explicit-implied.tf")
 	if diags.HasErrors() {
 		t.Fatal(diags.Error())
 	}

internal/configs/module.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/hashicorp/terraform/internal/addrs"
 	"github.com/hashicorp/terraform/internal/experiments"
-
 	tfversion "github.com/hashicorp/terraform/version"
 )
 

internal/configs/module_test.go

@@ -8,8 +8,9 @@ import (
 	"testing"
 
 	"github.com/hashicorp/hcl/v2"
-	"github.com/hashicorp/terraform/internal/addrs"
 	"github.com/zclconf/go-cty/cty"
+
+	"github.com/hashicorp/terraform/internal/addrs"
 )
 
 // TestNewModule_provider_fqns exercises module.gatherProviderLocalNames()
@@ -681,3 +682,14 @@ func TestModule_state_store_multiple(t *testing.T) {
 		}
 	})
 }
+
+func TestModule_nested_import_blocks(t *testing.T) {
+	m, diags := testNestedModuleConfigFromDir(t, "testdata/valid-modules/import-blocks-in-module")
+	if diags.HasErrors() {
+		t.Fatal(diags.Error())
+	}
+
+	if len(m.Children["child"].Module.Import) != 2 {
+		t.Fatal("child module is missing nested import blocks")
+	}
+}

internal/configs/parser_config_dir.go

@@ -71,7 +71,7 @@ func (p *Parser) LoadConfigDir(path string, opts ...Option) (*Module, hcl.Diagno
 	}
 	// Check if we need to load query files
 	if len(fileSet.Queries) > 0 {
-		queryFiles, fDiags := p.loadQueryFiles(path, fileSet.Queries)
+		queryFiles, fDiags := p.loadQueryFiles(fileSet.Queries)
 		diags = append(diags, fDiags...)
 		if mod != nil {
 			for _, qf := range queryFiles {
@@ -151,7 +151,7 @@ func (p Parser) ConfigDirFiles(dir string, opts ...Option) (primary, override []
 
 // IsConfigDir determines whether the given path refers to a directory that
 // exists and contains at least one Terraform config file (with a .tf or
-// .tf.json extension.). Note, we explicitely exclude checking for tests here
+// .tf.json extension.). Note, we explicitly exclude checking for tests here
 // as tests must live alongside actual .tf config files. Same goes for query files.
 func (p *Parser) IsConfigDir(path string, opts ...Option) bool {
 	pathSet, _ := p.dirFileSet(path, opts...)
@@ -205,7 +205,7 @@ func (p *Parser) loadTestFiles(basePath string, paths []string) (map[string]*Tes
 	return tfs, diags
 }
 
-func (p *Parser) loadQueryFiles(basePath string, paths []string) ([]*QueryFile, hcl.Diagnostics) {
+func (p *Parser) loadQueryFiles(paths []string) ([]*QueryFile, hcl.Diagnostics) {
 	files := make([]*QueryFile, 0, len(paths))
 	var diags hcl.Diagnostics
 

internal/configs/parser_test.go

@@ -52,9 +52,9 @@ func testModuleConfigFromFile(filename string) (*Config, hcl.Diagnostics) {
 	return cfg, append(diags, moreDiags...)
 }
 
-// testModuleFromFileWithExperiments File reads a single file from the given path as a
+// testModuleCfgFromFileWithExperiments File reads a single file from the given path as a
 // module and returns its configuration. This is a helper for use in unit tests.
-func testModuleFromFileWithExperiments(filename string) (*Config, hcl.Diagnostics) {
+func testModuleCfgFromFileWithExperiments(filename string) (*Config, hcl.Diagnostics) {
 	parser := NewParser(nil)
 	parser.AllowLanguageExperiments(true)
 	f, diags := parser.LoadConfigFile(filename)

internal/configs/testdata/valid-modules/import-blocks-in-module/child/main.tf

@@ -0,0 +1,15 @@
+provider "random" {
+    alias = "thisone"
+}
+
+import {
+    to = random_string.test1
+    provider = localname
+    id = "importlocalname"
+}
+
+import {
+    to = random_string.test2
+    provider = random.thisone
+    id = "importaliased"
+}

internal/configs/testdata/valid-modules/import-blocks-in-module/main.tf

@@ -0,0 +1,3 @@
+module "child" {
+    source = "./child"
+}

internal/refactoring/import_statement.go

@@ -0,0 +1,63 @@
+// Copyright IBM Corp. 2014, 2026
+// SPDX-License-Identifier: BUSL-1.1
+
+package refactoring
+
+import (
+	"github.com/hashicorp/terraform/internal/addrs"
+	"github.com/hashicorp/terraform/internal/configs"
+)
+
+type ImportStatement struct {
+	// AbsToResource is the original ImportConfig ToResource+ContainingModule
+	AbsToResource    addrs.ConfigResource
+	ContainingModule addrs.Module
+	Import           *configs.Import
+}
+
+// FindImportStatements recurses through the modules of the given configuration
+// and returns a set of all "import" blocks defined within after deduplication
+// on the To address.
+//
+// An "import" block in a parent module overrides an import block in a child
+// module when both target the same configuration object.
+func FindImportStatements(rootCfg *configs.Config) addrs.Map[addrs.ConfigResource, ImportStatement] {
+	imports := findImportStatements(rootCfg, addrs.MakeMap[addrs.ConfigResource, ImportStatement]())
+	return imports
+}
+
+func findImportStatements(cfg *configs.Config, into addrs.Map[addrs.ConfigResource, ImportStatement]) addrs.Map[addrs.ConfigResource, ImportStatement] {
+	for _, mi := range cfg.Module.Import {
+		// First, stitch together the module path and the RelSubject to form
+		// the absolute address of the config resource being removed.
+		res := mi.ToResource
+		toAddr := addrs.ConfigResource{
+			Module:   append(cfg.Path, res.Module...),
+			Resource: res.Resource,
+		}
+
+		// If we already have an import statement for this ConfigResource, it
+		// must have come from a parent module, because duplicate import
+		// blocks in the same module result in an error.
+		// The import block in the parent module overrides the block in the
+		// child module.
+		existingResource, ok := into.GetOk(toAddr)
+		if ok {
+			if existingResource.AbsToResource.Equal(toAddr) {
+				continue
+			}
+		}
+
+		into.Put(toAddr, ImportStatement{
+			AbsToResource:    toAddr,
+			ContainingModule: cfg.Path,
+			Import:           mi,
+		})
+	}
+
+	for _, childCfg := range cfg.Children {
+		into = findImportStatements(childCfg, into)
+	}
+
+	return into
+}