Terraform error: importing EC2 Key Pair (XXXX): InvalidKeyPair.Duplicate: The ke...

Terraform newbie here. I am trying to add an additional node group to existing terraform stack that has already been deployed in AWS region by someone else in my organization. I have run through the setup and I have edited the terraform.tf file to include my additional node group. When I come to apply I run into:-

│ Error: importing EC2 Key Pair (XXXXX): InvalidKeyPair.Duplicate: The keypair already exists
│       status code: 400, request id:XXXXXX-XXXX-XXXXX-XXXX-XXXXXX
│
│   with module.networks.aws_key_pair.user,
│   on modules\networks\ec2.tf line 1, in resource "aws_key_pair" "user":
│    1: resource "aws_key_pair" "user" {

Things I checked / tried:-

• That the AWS key pairs XXXXX is in my console and there is no duplicates.

• Tried the "terraform import" cmd with name | ID from the console but this draws me into a series of questions e.g. Regions, AZs that are already detailed in my script.

• Hardwiring my file modules\networks\ec2.tf with the key name and public key(rsa...)

Still not got me cigar so would welcome any suggestions

First thing is that the word import means two different things in the two adjacent tools here:

• In the context of EC2 Key Pair, if you have an existing public key, to create the resource in AWS with that public key, the API action for it is ImportKeyPair. This is what is being done, as mentioned in the question. In one account's region, there can be only one key pair with the same name; otherwise, you'd get the "The keypair already exists".
• In the context of Terraform, you can import resources into the state via terraform import command, which only modifies the state to add the information of the imported resource and doesn't create/update any resources on AWS.

In this case, Terraform is either not aware of the existing public key, or you are trying to create/import the same key twice in the same codebase state.

There are a few things one can do here:

• For each public key, ensure only one key is being created by Terraform in an account's region. If there's more, reference the existing key using data blocks if needed, or just pass the key name as a parameter and not have the resource multiple times.

• Ensure you have the correct Terraform state. If Terraform was used to deploy this resource properly, it should be in the state. It could be that either state configuration is wrong, some other state is being used by accident, or perhaps you don't have the state file.

• If it's not in state and there's only one defined in the codebase, the state was lost for any reason, or importing a missing resource is easier into a new state, then you can import it into the state. The documentation mentions that the keypair can simply be imported by its key_name. For example, if the key name is XXXXX per the question, then it can be imported with:

  $ terraform import aws_key_pair.user XXXXX
  

Region doesn't need to be specified in the import command as it is specified by the AWS provider configuration or the credentials. Although it would be good to double-check those before accidentally deploying into the wrong environment!