How to quickly import all records from a Route53 DNS zone into Terraform

`terraform import` is deliberately one resource at a time. That is fine for a handful of records, but a production Route 53 hosted zone can hold dozens or hundreds of rows—MX, TXT, weighted aliases, and more.

The pragmatic pattern is: export the live zone, generate matching HCL (or stubs) for your provider version, then loop imports with consistent credentials while you prove parity with `terraform plan`.

Why bulk import matters

Manual clicking through hundreds of imports invites fatigue errors—wrong address strings, skipped aliases, or mismatched provider schemas. Automation keeps the process repeatable and reviewable in pull requests.

State drift shows up fast if generated config does not match reality.
Sensitive records (SPF, DKIM, DMARC, ACME) need extra scrutiny before apply.
NS and SOA behavior differs by provider module—confirm what you are allowed to manage.

Reference workflow

List all record sets with AWS CLI pagination (`list-resource-record-sets`).
Normalize names (FQDN vs relative) and dedupe synthetic entries you should not import.
Emit `aws_route53_record` resources—or use a codegen script tuned to your Terraform AWS provider version.
Import each address in a loop; capture stderr to a log for later audit.
Plan until empty; only then treat the zone as fully under IaC.

Keep production changes behind the same review bar as application code: branch, plan in CI, and apply with narrow blast radius (one zone at a time). The header image on this post reflects the Terraform + Route 53 toolchain this workflow targets.

Safety rails

Record type	Watch out for
MX / NS	Breaking mail or delegation if TTL or targets drift
Alias A/AAAA	evaluate_target_health and dual-stack behavior
Weighted / latency	Routing policies and set identifiers must match exactly
TXT	Long strings, SPF concatenation, and 255-char chunks

Test scripts in a non-production account first. A mistaken apply on the wrong zone can take a business offline within DNS TTL windows.

Terraform + DNS essentials

Idempotent importsSame script re-run should skip or no-op completed addresses.

CLI paginationFull zone export before any HCL generation.

Plan until zero diffThe only proof the zone matches state.

Blast-radius controlOne zone, one change batch, observable rollback.

Conclusion

Bulk Route 53 import is boring infrastructure work—which is exactly why automation pays off. Invest once in a script that matches your provider constraints, and every future zone migration gets cheaper.

Need Terraform + AWS help?

I assist with:

Import playbooks for DNS, IAM, and networking baselines.
Module design so records stay DRY across environments.
CI integration for plan-on-PR workflows.

If you are stuck halfway through a zone import or fighting provider upgrades, a focused pairing session usually unblocks faster than guessing addresses.

Available for consulting on AWS, Terraform, and automation.

Get in touch →