• Terraform ≥ 1.5 recommended. Do not install or download Terraform automatically; Step 6 checks whether

  terraform

  is on PATH and reports the actual validation status.
• Network is required — Step 4.2 WebFetches each resource's provider doc.

• region

  — default

  cn-hangzhou

  .

• resources[]

  —

  { alicloud_type, quantity, attributes }

  .
• Non-functional: multi-AZ, encryption, backup, HA, IOPS.

• Expand

  resources[]

  with implied infra (VPC → VSwitch → SecurityGroup → workload); user parse often skips these.
• The expanded list is the input to Step 4's gate.

references/alicloud-providers.md

Read

grep

grep "alicloud_<name>" references/alicloud-providers.md

• Row found, status column empty → note the

  [doc](<url>)

  from the row; proceed to 4.2.
• **Row found, status

  ⚠️ 弃用 → 

  <new_name>

  ** → switch the plan to 

  <new_name>

  and re-lookup. NEVER emit the deprecated name. Common catch:

  alicloud_fc_function

  →

  alicloud_fcv3_function`.
• Row not found → stop. Ask the user whether the name was a typo; don't invent an

  alicloud_<guess>

  .

references/resource-patterns.md

zone_id_slave_a

undefined

• Required params (verbatim list from the doc, or from the local catalog if the 4.2 fallback was taken)
• 2–5 key Optional params relevant to the user's requirement
• A minimal HCL snippet from the doc's "Example Usage" (omit with the note

  no example available

  only when the fallback was taken)

data

• zone_id

  →

  data "alicloud_zones"

  (filter by

  available_resource_creation

  ).

• image_id

  →

  data "alicloud_images"

  (filter by

  name_regex

  ,

  owners = "system"

  ,

  most_recent = true

  ).

• instance_type

  →

  data "alicloud_instance_types"

  (filter by

  cpu_core_count

  ,

  memory_size

  , AZ).

*.tf

*.tf

terraform { required_providers {} }

terraform {
  required_version = ">= 1.5"
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "~> 1.274"
    }
  }
}

• Provider version: resolve the latest published stable

  aliyun/alicloud

  1.x version, then write a pessimistic minor constraint (

  1.278.0

  ->

  ~> 1.278

  ). Lookup sources, in order:

  1. https://registry.terraform.io/v1/providers/aliyun/alicloud/versions

  2. https://registry.terraform.io/providers/aliyun/alicloud/latest

  3. https://github.com/aliyun/terraform-provider-alicloud/releases

     or

     https://github.com/aliyun/terraform-provider-alicloud/tags

• If lookup fails, fall back to

  ~> 1.274

  . Accepted form is

  ~> 1.<minor>

  from a confirmed published 1.x release. Do NOT write open-ended constraints (

  >= 1.x

  ,

  >= 1.239.0

  ) or bare version strings.

provider "alicloud" {}

region = var.region

configuration_source

provider "alicloud" {
  region               = var.region
  configuration_source = "AlibabaCloud-Agent-Skills/alibabacloud-terraform-code-generation"
}

• configuration_source

  is the attribution signature — required.

• region

  MUST reference

  var.region

  , not a hardcoded literal.

terraform.tf

providers.tf

versions.tf

main.tf

*.tf

undefined

• 2-space indent;

  =

  aligned within a block; snake_case semantic resource labels (

  alicloud_vswitch.app_a

  , not

  vsw1

  ).
• Every tag-supporting resource should carry a non-empty

  tags

  block for ops hygiene — pick reasonable keys for the scenario (common choices:

  ManagedBy

  ,

  Project

  ,

  Environment

  ,

  CreatedBy

  ). Skill does not prescribe specific tag keys or values.

terraform

references/deprecated-fields.md

• rename row → if the old field name appears in HCL you just wrote, replace it with the new field name. Examples that show up most often:

  • alicloud_ram_role

    :

    name

    →

    role_name

    ,

    document

    →

    assume_role_policy_document

  • alicloud_security_group

    :

    name

    →

    security_group_name

  • alicloud_db_database

    :

    name

    →

    data_base_name

• split / soft-split row → do NOT write the inline field on the parent. Declare the replacement sub-resource only when the user's requirement needs that capability, or when

  references/resource-patterns.md

  says the sub-resource has an explicit safe default. Example: for OSS buckets,

  alicloud_oss_bucket_acl

  defaults to

  private

  , but logging/CORS/website sub-resources are omitted unless the user asks for those features.
• deprecated-no-replacement row → stop using the field, no substitute.

undefined

alicloud_' references/deprecated-fields.md | while IFS='|' read _ resource field kind _; do   resource=$(echo "$resource" | tr -d ' 

Only check if this resource exists in the generated HCL

**HARD GATE: must pass before Step 6** — If the script above produces
any `DEPRECATED:` line:

1. Read each `DEPRECATED:` line — it names the resource and field.
2. Look up that resource+field in `references/deprecated-fields.md`
   to get the **Action** column (rename target, split sub-resource,
   etc.).
3. Apply the fix in the HCL.
4. Re-run the verification script.
5. Repeat until **every line returns `OK:`**. This is a blocking gate —
   do NOT proceed to Step 6 with any `DEPRECATED:` output. Do NOT claim
   "verified" unless the script produces all `OK:`.

terraform

(cd <target-dir> \
  && terraform fmt -recursive \
  && terraform init -backend=false \
  && terraform validate -json)

1. Parse

   validate -json

   . If there are errors → fix the offending file, then go to step 3.
2. Scan

   validate -json

   diagnostics[].summary

   for

   [DEPRECATED]

   strings. The provider emits authoritative deprecation annotations (e.g.

   "document": "[DEPRECATED] … New field 'assume_role_policy_document' instead."

   ). If found → fix the matching field, then go to step 3.
3. Re-run

   cd <target-dir> && terraform validate -json

   and go back to step 1.

[DEPRECATED]

Validation: FAILED (<diagnostic excerpt>)

init

registry.terraform.io

references/auth-and-network.md

Validation: SKIPPED (init failed — network/unreachable)

~/.terraformrc

terraform

Validation: SKIPPED (terraform binary not on PATH)

Files written:

Validation:

<bracketed>

Files written:

Validation:

Files written:
<path/to/file1>
<path/to/file2>
...

Validation: <one-of-four-exact-strings-below>

Deprecation routing: <If re-routed: `<original_name>` → `<new_name>`; else: None>

<optional: architecture notes, design decisions, deploy hints — free-form
here is fine, but NOT inside the lines above>

Validation:

• Validation: terraform fmt+validate: ok

• Validation: SKIPPED (terraform binary not on PATH)

• Validation: SKIPPED (<reason>)

• Validation: FAILED (<diagnostic excerpt>)

  — after 3 retries hit the cap

• Init timeout →

  Validation: FAILED (init timed out — provider installation exceeded time limit)

• Init network-unreachable →

  Validation: SKIPPED (init failed — network/unreachable)

• Init failed after fmt succeeded → use the root-cause string above, not a hybrid status.

references/auth-and-network.md

(
  [[ -n "${ALIBABA_CLOUD_ACCESS_KEY_ID:-}" ]] && [[ -n "${ALIBABA_CLOUD_ACCESS_KEY_SECRET:-}" ]] && echo "ready:env-ak-sk"
  [[ -f "$HOME/.aliyun/config.json" ]]                                                           && echo "ready:shared-config"
  { [[ -n "${ALIBABA_CLOUD_CREDENTIALS_FILE:-}" ]] && [[ -f "${ALIBABA_CLOUD_CREDENTIALS_FILE}" ]]; } && echo "ready:custom-credentials-file"
  [[ -n "${ALIBABA_CLOUD_ECS_METADATA:-}" ]]                                                      && echo "ready:ecs-ram-role"
  [[ -n "${ALIBABA_CLOUD_ROLE_ARN:-}" ]]                                                          && echo "ready:assume-role"
  [[ -n "${ALIBABA_CLOUD_CREDENTIALS_URI:-}" ]]                                                   && echo "ready:sidecar"
) | head -1

• Any line of output → a credential path is available:

  (cd <target-dir> && terraform init && terraform plan -out=tfplan)

  ; surface the output.
• Empty output →

  NO_CREDENTIALS

  . Tell the user about all viable paths (env AK/SK, shared

  ~/.aliyun/config.json

  +

  ALIBABA_CLOUD_PROFILE

  , ECS instance RAM role, Assume Role chain, OIDC/RRSA, sidecar URI) — do NOT just push env AK/SK. Point them at

  references/auth-and-network.md

  for the full setup. Then stop. Never read or print secret values.