Importer: emit Terraform that actually imports

[bshutterkion]

Run against a live Kion (843 resources), the generated configuration and its import script disagreed in seven ways. Every one meant resources that could not be imported — and the last meant a permanent terraform plan diff.

What was broken

1. Nested modules were never declared. OU and project cloud access roles are written into per-parent subdirectories, but Terraform only loads .tf files directly inside a module's source directory. Nothing declared those, so every role in them was invisible: resource address ... does not exist in the configuration. They also need their own provider.tf — a child module that doesn't declare required_providers resolves kion_* against the default namespace and fails with hashicorp/kion.

2. Their import addresses were malformed. import_ou_roles built module.ou-cloud-access-role.kion.<ou_dir>_ou_cloud_access_role.<name>, splicing the directory into the resource type. import_project_roles omitted the module segment entirely, collapsing three different Developer roles in three different projects onto one address.

3. Colliding names silently destroyed data. Two CloudFormation templates both named CIS-EnableVPCFlowLogs (ids 81, 182) normalised to one label, so the second .tf overwrote the first — one resource vanished from the configuration — while both claimed the same import address. Same for two IAM policies named deny-non-tagged-resources. unique_label() appends the Kion id on collision; the first to claim a name keeps the clean label.

4. A leading digit produced invalid HCL. A block label may start with a digit because it is quoted; the reference emitted beside it may not, so a resource named 800-53 Audit made Terraform reject the whole file. This also affected every name under --prepend-id, which always prepends a digit.

5. aws_permissions_boundary_id — a name neither provider has ever accepted. Both call it aws_iam_permissions_boundary.

6. Ownership was looked up by a hardcoded app_role_id == 1. App roles are installation-specific. On the instance tested, ownership was a custom role named Owner with id 67 while id 1 was the system-managed Admin; 14 project mappings used role 1 and 26 used role 67. Now resolved by role name, taking the union of Owner and Admin. OUs get a second source: /v3/ou/{id} returns owner_users: null for OUs whose ownership is a permission mapping, so it falls back to the mapping.

7. process_string collapsed whitespace and rewrote quotes. Descriptions are markdown with meaningful indentation; collapsing \s{2,} to a single space meant the configuration disagreed with the API on every indented line, permanently. Double quotes were replaced with single quotes for the same reason. Now escaped properly — indentation, embedded quotes, backslashes and ${...} all round-trip.

Verified end to end

	before	after
import statements / distinct addresses	843 / 829	843 / 843
failures in a 56-resource sample	17	0
parse errors across 850 files	2	0
projects with no inferable owner	11 of 37	0

Validated end to end on that instance: the importer enumerates the installation, and every one of the 843 emitted terraform import statements resolves to an address that exists in the generated configuration and imports cleanly.