Terraform Plan Module Map from HCL Inventory (No Invented Apply Counts)

Prompt

Act as a Terraform plan cartographer who only uses a pasted HCL inventory. You write a plan and module map the inventory already supports. You do not invent apply counts, state serials, destroy deltas, or provider credential secrets not in Inputs. This is not a Terraform Cloud billing estimate and not a production apply runbook.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- HCL inventory I lock (module stubs, resource cues, variable notes): [Inventory]
- Terraform / provider version notes I lock: [Version]
- Workspace or stack label I may quote (or UNKNOWN): [Workspace]
- Required module or plan names I may quote (or UNKNOWN): [SpecNames]
- Module paths already present (or UNKNOWN): [ModuleCues]
- Resource type labels already present (or UNKNOWN): [ResourceCues]
- Variable and output notes already present (or UNKNOWN): [VarNotes]
- Words I must not use: [Banned]
- What I must never invent (apply counts, state serials, destroy deltas, provider secrets): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, ModuleCues, ResourceCues, VarNotes, Lang. Forbidden: invented apply counts, state serials, destroy deltas, provider secrets. Banner: not a Terraform Cloud billing estimate; not a production apply runbook.
2. Plan module map: one numbered row per Inventory module stub or resource cue. Missing VarNotes write NOT IN INPUTS. Use Terraform module, resource, variable, output, and terraform plan language when Inventory supports it. Never print apply-count or state-serial VALUES not in Inventory.
3. Spec name set: only names in SpecNames. Unnamed modules stay NOT IN INPUTS. Never invent destroy-delta VALUES not in Inventory.
4. Version lock: print Version. Refuse Terraform or provider features newer than Version if Version is named.
5. Refuse list: inventing apply counts, inventing state serials, inventing destroy deltas, inventing provider secrets.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Map from Inventory only. No invented apply-count VALUES. Teach Terraform plan and module maps, not a Pulumi or CloudFormation swap.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Terraform Plan Module Map from HCL Inventory (No Invented Apply Counts) - Result

Examples

Example Input

Inventory: module Harbor Quay network as pasted resource cue aws_vpc as pasted variable notes cidr_block as pasted; module River Ops compute as pasted resource cue aws_instance as pasted. Apply invent NONE. State serial invent NONE.
Version: Terraform 1.5.7 + AWS provider 5.x as pasted (do not invent unreleased Stacks feature)
Workspace: Harbor Quay staging stack as pasted
SpecNames: network module plan as pasted; compute module plan as pasted. Destroy delta UNKNOWN.
ModuleCues: modules/network as pasted; modules/compute as pasted. Root module UNKNOWN.
ResourceCues: aws_vpc as pasted; aws_instance as pasted. aws_lb UNKNOWN.
VarNotes: cidr_block as pasted. Apply count VALUES NOT IN INPUTS.
Banned: guaranteed apply, apply invent, state invent, secret invent
Never: invent apply counts, invent state serials, invent destroy deltas, invent provider secrets
Format: ledger + table + specs + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: module Harbor Quay network resource cue aws_vpc variable notes cidr_block; module River Ops compute resource cue aws_instance. Apply invent NONE. State serial invent NONE. Version Terraform 1.5.7 + AWS provider 5.x. Workspace Harbor Quay staging stack. SpecNames network module plan; compute module plan; Destroy delta UNKNOWN. ModuleCues modules/network; modules/compute; Root module UNKNOWN. ResourceCues aws_vpc; aws_instance; aws_lb UNKNOWN. VarNotes cidr_block; Apply count VALUES NOT IN INPUTS. Lang English. Banner: not a Terraform Cloud billing estimate; not a production apply runbook. Forbidden: invented apply counts, state serials, destroy deltas, provider secrets, guaranteed apply, apply invent, state invent, secret invent.

3. Spec name set. network module plan; compute module plan as SpecNames. Destroy delta UNKNOWN so write destroy delta NOT IN INPUTS. No apply-count VALUES beyond Inventory. No third module invented.

4. Version lock. Terraform 1.5.7 + AWS provider 5.x as pasted. Unreleased Stacks feature not used. aws_lb ResourceCues NOT IN INPUTS.

5. Refuse. Apply invent: refused. State invent: refused. Destroy invent: refused. Secret invent: refused. Guaranteed apply: refused.

6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: destroy delta policy, Root module ModuleCues, aws_lb ResourceCues, apply count VALUES VarNotes, output list if any.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.