Terraform ignore_changes will not protect a pre-created secret

If someone creates an AWS Secrets Manager secret by hand before Terraform applies a config that declares it (secret + secret_version with lifecycle ignore_changes on secret_string), the apply either fails on the existing name or, if only the secret is imported, creates a NEW version with the placeholder string and makes it AWSCURRENT, silently replacing the real value. ignore_changes only applies after the resource is in state. Import both: the secret by ARN and the version as <arn>|<version-id>, then plan to confirm no version create.