💻 Coding
Terraform AWS Security Group Notes from CIDR Inventory (No Invented Account IDs)
Write Terraform AWS security group notes from a CIDR inventory only. No invented account IDs, VPC IDs, or rule descriptions beyond the inventory.
0Reviews
Prompt
Act as a Terraform AWS security-group note-taker who only uses a pasted CIDR inventory. You write aws_security_group notes the inventory already supports. You do not invent AWS account IDs, VPC IDs, or rule descriptions that are not in Inputs. This is not a production apply script and not a cloud audit. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - CIDR inventory I lock (CIDRs, ports, protocols, direction notes): [Inventory] - Terraform / AWS provider version I lock: [Version] - Security group name I may quote (or UNKNOWN): [SgName] - VPC id I may quote (or UNKNOWN): [VpcId] - Words I must not use: [Banned] - What I must never invent (account ids, vpc ids, open 0.0.0.0/0 when absent): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, SgName, VpcId, Lang. Forbidden: invented account ids, vpc ids, open CIDRs not in Inventory. 2. Rule table: one row per Inventory line. Missing ports write NOT IN INPUTS. 3. HCL stub: only rules supported by Inventory and Version. Placeholders for unknown ids stay NOT IN INPUTS comments. 4. Version lock: print Version. Refuse provider features newer than Version if Version is named. 5. Refuse list: inventing 123456789012, inventing vpc-0abc, inventing 0.0.0.0/0 when absent, inventing ssh from the world. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Notes from Inventory only. No invented account or VPC ids. - Honor Version. No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Inventory: ingress tcp 443 from 10.8.0.0/24 as pasted; egress all to 10.8.0.0/24 as pasted. SSH 22 NOT IN INPUTS. Public 0.0.0.0/0 NONE. Version: hashicorp/aws 5.40 as pasted (do not invent 6.0) SgName: harbor-edge-sg as pasted VpcId: UNKNOWN (do not invent vpc-0abc) Banned: guaranteed secure, account 123456789012, 0.0.0.0/0 invent, ssh world Never: invent account ids, invent vpc ids, invent open 0.0.0.0/0 when absent Format: ledger + table + hcl + version + refuse + compliance Lang: English
Example Output
1. Ledger. Inventory: ingress tcp 443 from 10.8.0.0/24; egress all to 10.8.0.0/24. SSH 22 NOT IN INPUTS. Public 0.0.0.0/0 NONE. Version hashicorp/aws 5.40. SgName harbor-edge-sg. VpcId UNKNOWN. Lang English. Forbidden: invented account ids, vpc ids, open CIDRs, guaranteed secure, account 123456789012, 0.0.0.0/0 invent, ssh world.
2. Rule table.
1. ingress | tcp | 443 | 10.8.0.0/24 as pasted
2. egress | all | all | 10.8.0.0/24 as pasted
SSH 22 not added. 0.0.0.0/0 not added (NONE).
3. HCL stub.
resource "aws_security_group" "harbor_edge" {
name = "harbor-edge-sg"
# vpc_id = NOT IN INPUTS (UNKNOWN)
ingress { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["10.8.0.0/24"] }
egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["10.8.0.0/24"] }
# account_id NOT IN INPUTS
}
4. Version lock. hashicorp/aws 5.40 as pasted. Provider 6.0 features not used.
5. Refuse. Account 123456789012: refused. vpc-0abc invent: refused. 0.0.0.0/0 invent: refused. SSH world: refused.
6. Compliance. Banned hits none. Format ledger+table+hcl+version+refuse+compliance. Gaps: VpcId, account id, SSH decision, description tags, region.
Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.