# Terraform Code Generator

> Generate and modify Alibaba Cloud Terraform HCL code. Triggers on phrases like: write Terraform for Alibaba Cloud, create alicloud Terraform config, generate HCL for ECS, Terraform code for VPC, alicloud infrastructure as code, Terraform resource for RDS, modify Terraform configuration, alicloud provider Terraform.

- Skill: `acloudlabs-unofficial/terraform-code-generator` (Agent Skill)
- Install (CLI): `npx skillmds@latest add acloudlabs-unofficial/terraform-code-generator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/acloudlabs-unofficial/terraform-code-generator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: acloudlabs-unofficial (https://skillmd.com/u/acloudlabs-unofficial)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/acloudlabs-unofficial/terraform-code-generator

---


# Alibaba Cloud Terraform Code Generator

Generate and modify production-quality Alibaba Cloud Terraform (HCL) configurations from natural language descriptions.

## ⚠️ CRITICAL SAFETY RULES

1. **ONLY use tools from the `terraform-usage` MCP server.** The permitted tools are:
   - `AlibabaCloud___CallCLI` — Execute IaCService CLI commands to query Terraform product/resource metadata
   - `AlibabaCloud___SearchDocument` — Search Alibaba Cloud documentation by keyword to find relevant document URLs
   - `AlibabaCloud___ReadDocument` — Read a specific document by URL (must use URLs obtained from `SearchDocument`)
2. **Do NOT use shell, terminal, or any other execution tool** to run `terraform plan`, `terraform apply`, or any other Terraform commands. Generated HCL code is for the user to review and apply themselves.
3. **Always remind the user to review the generated HCL** before running `terraform apply`, especially when resources involve costs, data deletion, or security-sensitive configurations.
4. The MCP server safety policy (`iacservice-*=allow,*=deny`) only permits IaCService API calls via `CallCLI`. All other CLI commands are blocked.

## IaCService API Reference

All IaCService APIs must be invoked through `AlibabaCloud___CallCLI`. The following APIs are available:

| API | CLI Command | Purpose |
| --- | ----------- | ------- |
| `IaCService/2021-08-06/ListProducts` | `aliyun iacservice list-products` | List all Alibaba Cloud products that support Terraform |
| `IaCService/2021-08-06/ListResourceTypes` | `aliyun iacservice list-resource-types --product <product>` | List Terraform resource types for a specific product |
| `IaCService/2021-08-06/GetResourceType` | `aliyun iacservice get-resource-type --resource-type <resourceType>` | Get all attributes and schema for a Terraform resource type (e.g., `alicloud_vpc`) |

## Workflow

Follow these steps strictly in order:

### Step 1: Understand the User's Intent

Parse the user's natural language request to identify:
- The target Alibaba Cloud service(s) (e.g., ECS, VPC, RDS, OSS, SLB, ACK)
- The desired infrastructure (e.g., create a VPC with subnets, launch an ECS instance, set up an RDS database)
- Any specific requirements (e.g., region, instance type, CIDR blocks, security group rules)
- Whether this is a new configuration or a modification to existing HCL code

### Step 2: Discover Supported Products and Resource Types

Call `AlibabaCloud___CallCLI` with `aliyun iacservice list-products` to confirm the target product supports Terraform.

Then call `AlibabaCloud___CallCLI` with `aliyun iacservice list-resource-types --product <product>` (using the product identifier from Step 2) to discover the correct Terraform resource type names (e.g., `alicloud_vpc`, `alicloud_instance`, `alicloud_db_instance`).

- If the user's request spans multiple products, query each product separately
- Present the matched resource types to the user if there is ambiguity

### Step 3: Get Resource Type Schema

Call `AlibabaCloud___CallCLI` with `aliyun iacservice get-resource-type --resource-type <resourceType>` (e.g., `--resource-type alicloud_vpc`) to retrieve the full attribute schema.

- Identify all required and optional attributes
- Understand attribute types, constraints, and valid values
- Note any attribute dependencies or conflicts

### Step 4: Consult Terraform Documentation

Documentation lookup is a **two-step process**:

1. **Search**: Use `AlibabaCloud___SearchDocument` with the resource type name (e.g., `alicloud_vpc`) as the keyword to find relevant documentation URLs
2. **Read**: Use `AlibabaCloud___ReadDocument` with a URL obtained from the search results to read the full document content

**Important:** You must always search first to get valid document URLs. Do NOT pass arbitrary URLs or resource names directly to `ReadDocument` — it only accepts URLs returned by `SearchDocument`.

After reading the documentation:
- Review usage examples and best practices
- Understand attribute-level details that may not be captured in the schema
- Check for known limitations or caveats
- Look for related data sources that may be useful (e.g., `data.alicloud_zones`, `data.alicloud_instance_types`)

### Step 5: Generate or Modify HCL Code

Based on the gathered information:

1. Write clean, well-structured HCL code following Terraform best practices
2. Include the `alicloud` provider configuration if this is a new configuration
3. Use `variable` blocks for values the user should customize (e.g., region, instance type, CIDR)
4. Use `locals` for computed or derived values
5. Add `output` blocks for important resource attributes (e.g., IDs, IP addresses)
6. Include meaningful `description` fields in variables and outputs
7. Use data sources where appropriate (e.g., `data.alicloud_zones` for available zones)

### Step 6: Present the Code

Present the generated HCL code with:

- A brief explanation of the infrastructure being created
- A list of resources and their relationships
- Any variables the user needs to customize
- **A reminder to review before running `terraform apply`**
- Warnings for any cost-incurring or destructive resources

## HCL Best Practices

- **Provider configuration**: Always include `region` in the provider block or as a variable
- **Resource naming**: Use descriptive resource names (e.g., `alicloud_vpc.main`, `alicloud_instance.web_server`)
- **Tags**: Include tags for resource identification and cost tracking
- **Dependencies**: Use `depends_on` only when implicit dependencies are insufficient
- **Security groups**: Default to restrictive rules; only open necessary ports
- **State management**: Suggest remote backend configuration for team usage
- **Modules**: Suggest module extraction when the configuration grows complex

## Error Recovery with Documentation

When you encounter unclear attribute definitions or constraints:

1. Use `AlibabaCloud___SearchDocument` with relevant keywords (resource type name, attribute name, error message) to find documentation URLs
2. Use `AlibabaCloud___ReadDocument` with the URL from search results to read the full documentation
3. Cross-reference the schema from `get-resource-type` (via `AlibabaCloud___CallCLI`) with the documentation
4. Provide the user with links to official documentation for edge cases

## Principles

- **Correctness** — Always verify resource schemas and documentation before generating code; never guess attribute names or valid values
- **Best practices** — Follow Terraform and Alibaba Cloud best practices for security, naming, and structure
- **Completeness** — Include all required attributes and sensible defaults for optional ones
- **Readability** — Write clean, well-commented HCL that is easy to understand and maintain
- **Safety** — Warn about cost implications and destructive operations; never execute Terraform commands