Terraform Module Input Output Map from HCL Inventory (No Invented Secrets)

Prompt

Act as a Terraform platform engineer who only uses a pasted HCL inventory. You write a module input/output map the inventory already supports. You do not invent secrets, remote-state backends, provider credentials, or account IDs. This is not a live terraform apply and not a cloud security attestation.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- HCL inventory I lock (module stubs, variable cues, output notes): [Inventory]
- Terraform / provider version notes I lock: [Version]
- Workspace or root module label I may quote (or UNKNOWN): [Workspace]
- Required variable or output names I may quote (or UNKNOWN): [SpecNames]
- Words I must not use: [Banned]
- What I must never invent (secrets, remote-state backends, provider credentials, account IDs): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, Lang. Forbidden: invented secrets, remote-state backends, provider credentials, account IDs. Banner: not a live terraform apply; not a cloud security attestation.
2. Module input/output map table: one row per Inventory module stub or variable cue. Missing output notes write NOT IN INPUTS.
3. Spec name set: only names in SpecNames. Unnamed specs stay NOT IN INPUTS. Never print secret VALUES or backend URLs not in Inventory.
4. Version lock: print Version. Refuse Terraform language features newer than Version if Version is named.
5. Refuse list: inventing secrets, inventing remote-state backends, inventing provider credentials, inventing account IDs.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Map from Inventory only. No invented secret VALUES.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Terraform Module Input Output Map from HCL Inventory (No Invented Secrets) - Result

Examples

Example Input

Inventory: module Harbor Quay VPC as pasted variable cue cidr_block as pasted output note vpc_id as pasted; module River Ops RDS as pasted variable cue instance_class as pasted. Secret NOT IN INPUTS. Backend NONE.
Version: Terraform 1.7 as pasted (do not invent unreleased ephemeral resource APIs)
Workspace: harbor-quay-prod as pasted
SpecNames: cidr_block as pasted; vpc_id as pasted; instance_class as pasted. db_password UNKNOWN.
Banned: guaranteed secret, backend invent, credential invent, account invent
Never: invent secrets, invent remote-state backends, invent provider credentials, invent account IDs
Format: ledger + table + specs + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: module Harbor Quay VPC variable cue cidr_block output note vpc_id; module River Ops RDS variable cue instance_class. Secret NOT IN INPUTS. Backend NONE. Version Terraform 1.7. Workspace harbor-quay-prod. SpecNames cidr_block; vpc_id; instance_class; db_password UNKNOWN. Lang English. Banner: not a live terraform apply; not a cloud security attestation. Forbidden: invented secrets, remote-state backends, provider credentials, account IDs, guaranteed secret, backend invent, credential invent, account invent.

2. Module input/output map.
1. Harbor Quay VPC | variable cidr_block as pasted | output vpc_id as pasted | secret NOT IN INPUTS | backend NONE.
2. River Ops RDS | variable instance_class as pasted | output NOT IN INPUTS | secret NOT IN INPUTS | backend NONE.
Provider credentials not printed. Account IDs not invented.

3. Spec name set. cidr_block; vpc_id; instance_class as SpecNames. db_password UNKNOWN so write db_password NOT IN INPUTS. No secret VALUES printed. No fourth variable invented.

4. Version lock. Terraform 1.7 as pasted. Unreleased ephemeral resource APIs not used. Provider pin schema NOT IN INPUTS.

5. Refuse. Secret invent: refused. Backend invent: refused. Credential invent: refused. Account invent: refused. Guaranteed secret: refused.

6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: output for River Ops RDS, db_password decision, backend address if any, provider aliases, module source path.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.