alibabacloud-terraform-code-generation

# Alibaba Cloud Terraform Code Generation Turn natural-language Alibaba Cloud infrastructure requirements into validated Terraform for the current `aliyun/alicloud` provider. Resource schema and validation are resolved through IaCService via MCP; Terraform provider docs and local reference files are used for HCL argument shape, examples, deprecations, and product-specific guardrails. ## Hard rules (never violate) ### 1. Credentials — never leak, never require NEVER read, print, ask for, or write AK/SK values anywhere — HCL, comments, env declarations, shell output, logs. The provider reads credentials itself from env, shared config, RAM role, OIDC/RRSA, sidecar, or static HCL. Do NOT recommend deprecated `ALICLOUD_*` or `ALIBABACLOUD_*` env names; current names are `ALIBABA_CLOUD_ACCESS_KEY_ID`, `_ACCESS_KEY_SECRET`, and `_SECURITY_TOKEN`. ### 2. Honest reporting — never claim a step you didn't run Never report `fmt: ok` / `validate: ok` / `plan: ok` unless the corresponding command actually executed AND returned that status. When a step is skipped (tool missing, user opt-out), state **"SKIPPED"** (or **"FAILED"**) with a reason. Paraphrasing real output is fine; fabricating it is not. ### 3. Validation and execution boundary Never run `terraform apply`. Run `terraform plan` only when the user asks. Validation uses IaCService MCP when available, otherwise local `terraform fmt/init/validate` when the binary exists. Never claim validation passed unless that exact path r...