Import existing infrastructure

If you already have servers, networks, or storage running on a cloud provider, you don’t need to recreate them to see them in Sencai. There are two ways to bring existing infrastructure in: a discovery scan against a connected account (the primary path, and the one most teams should start with), or an import from a Terraform state file if your infrastructure is already managed with Terraform.

Discover and adopt from a connected account

1. Connect the account and scan it

Connect a cloud provider account first, if you haven’t already. From Settings → Cloud Credentials (/gravity/settings/cloud-credentials), click Run scan on a validated credential’s row - this requires the Admin or Owner role. A scan is read-only: it only lists what already exists in your account, it never creates, changes, or deletes anything there.

The scan runs in the background - you’ll see a confirmation that it started, not an instant result. Results appear in Compliance & Audit → Inventory (/gravity/inventory) shortly after.

Turning on automatic scanning for a credential re-runs this same read-only scan on a recurring schedule, so newly created or removed resources in your account keep showing up without you having to trigger a scan by hand.

What a scan finds depends on the provider - see Permissions your credentials need for the resource kinds each provider covers. Every provider at minimum discovers compute instances; several also discover networks, storage volumes, load balancers, and more.

2. Review what was discovered - Inventory

Inventory lists every discovered resource across all your connected providers: what it is, which provider and region it’s in, its tags, and its current ownership state. You can filter by provider, region, resource type, tag, or ownership, search across everything, and export the current view as CSV or JSON.

Every discovered resource starts as unmanaged - visible, but not yet something Sencai tracks or lets you control.

3. Adopt - decide how Sencai should treat it

Select one or more resources and choose Adopt to set how Sencai should treat them going forward (requires the Member role or higher):

Option	What it means
Manage with Sencai	Sencai can perform write operations on it going forward. Adds a small set of Sencai tags to the real resource at the provider (who adopted it and when) - this is the one part of adoption that touches your actual cloud account.
Read-only tracking	Sencai displays and monitors it, but write operations stay blocked. Also adds the same tracking tags at the provider.
Ignore	Hides it from the default inventory view (useful for legacy or decommissioned resources). No tags are added - nothing changes at the provider.

Adopting a single resource that looks like a compute instance also offers to adopt related resources found in the same scan - its network, subnet, or security groups - together, so you don’t end up tracking a server without the network it depends on.

4. Promote - turn a discovered instance into a fully managed one

Adoption alone doesn’t let Sencai start, stop, or destroy a resource - it only labels and (optionally) tags it. For a resource that’s shaped like a compute instance, network, or block-storage volume, use Import as managed instance / network / disk (Admin role or higher) to go further: this creates a real, independently tracked Sencai record for it - a cloud instance, a network, or a storage volume - pointed at the same real resource.

This is a bigger step than adoption: once promoted, the resulting record is what you manage from its own dedicated screen, and stop/start/destroy become real operations against the actual resource, not just Sencai metadata. Promoting itself doesn’t change anything in your cloud account at the moment you do it - it’s the operations you take afterward, through the resulting instance/network/volume record, that do.

A promoted resource can’t be double-imported - running promote again on the same resource returns the same managed record rather than creating a second one.

Caution

A server brought in this way is visible and billable through Sencai immediately, but it won’t automatically get a Sencai-managed access account or the browser terminal the way a freshly-provisioned instance does - that setup only runs on an instance’s very first boot, which already happened before Sencai knew about the server. Finish that setup manually the first time; the app links you to the exact steps once you promote a host.

Object storage (S3-style buckets) can’t be promoted this way - only block-storage disks. If a resource type isn’t one Sencai promotes yet, you can still adopt it for read-only tracking.

Re-scanning and drift

Because scanning is safe to repeat, re-run it whenever you want an up-to-date picture - manually, or on the automatic schedule described above. If a tracked resource’s real-world state has diverged from what Sencai last recorded, it shows up as drift, with a badge on the Inventory screen linking to the details.

Import from a Terraform state file

If your infrastructure is managed with Terraform, Import from Terraform state (/gravity/instances/import, also reachable from the instances list) reads an existing terraform.tfstate - either uploaded directly or fetched from a URL you provide (S3, GCS, or a plain HTTPS link) - and creates instance records from the resources it recognizes.

This path only reads your state file; it never writes to it, and it never generates or modifies Terraform files. Uploaded files are capped at 10 MB.

Import runs asynchronously, the same way provisioning does - you’ll see a running count, then a summary of how many resources were imported, skipped (already imported, or a type Sencai doesn’t recognize), or failed.

Coverage today is narrower than a full discovery scan: it recognizes a specific set of Terraform resource types (AWS, Google Cloud, Azure, and Hetzner compute resources, among them) rather than everything a provider-native scan finds. If your state file includes resource types outside that set, they’re skipped rather than partially imported.

Which path should I use?

• Have a connected cloud account and want the full picture (instances, networks, storage, and more) - use the discovery scan. It’s the more complete path and doesn’t depend on you already using Terraform.
• Already manage everything with Terraform and just want the compute resources tracked quickly - the state-file import can be faster for that narrower goal.

Both paths are safe to use on the same account - scanning after a Terraform import just shows the same resources as already adopted/promoted rather than duplicating them.

What’s next

• Connect a cloud provider
• Permissions your credentials need - what a discovery scan can see per provider
• Provision & manage instances
• Roles - who can scan, adopt, and promote