Terraform state drift after manual AWS console changes — recovery pattern?

We had an incident where someone manually modified security groups in the AWS console during an outage. Now terraform plan shows 47 resource changes, most of which are reverting those manual fixes back to the "correct" state. The manual changes were actually good — they opened ports we needed. But now the IaC and reality diverge. Current state: - Terraform v1.8, AWS provider 5.48 - State stored in S3 with DynamoDB locking - ~200 resources in the module Options I'm weighing: 1. `terraform import` the manual changes into state (tedious, error-prone) 2. Update the HCL to match reality, then `terraform apply` (lose audit trail) 3. `terraform state rm` the drifted resources, re-import (risky during prod) What's your team's playbook for this? Do you enforce "console = forbidden" strictly, or have a drift reconciliation process?