Setting the file. One moment.
Subchapter 27.1
references/clustering/terraform/classification-rules.mdMarkdown7 KBView on GitHub
Hardcoded lists for classifying GCP resources as PRIMARY or SECONDARY.
Each PRIMARY resource is assigned a tier indicating its infrastructure layer.
These resource types are excluded from classification, clustering, and migration. Do not classify them as PRIMARY or SECONDARY. Do not create clusters for them. Do not include them in gcp-resource-inventory.json.
Third-party and GCP-adjacent authentication resources. Users should keep their existing auth provider — do not recommend migrating to AWS Cognito or any AWS auth service.
google_identity_platform_* — GCP Identity Platform (all variants: config, tenant, default_supported_idp_config, inbound_saml_config, oauth_idp_config)google_firebase_auth_* — Firebase Authentication (all variants)If encountered: log as “Auth provider detected — excluded from migration scope. Keep your existing auth solution.” and skip.
These resource types are always PRIMARY:
google_cloud_run_service — Serverless container workloadgoogle_cloud_run_v2_service — Serverless container workload (v2 API)google_container_cluster — Kubernetes clustergoogle_container_node_pool — Kubernetes node poolgoogle_compute_instance — Virtual machinegoogle_cloudfunctions_function — Serverless function (Gen 1)google_cloudfunctions2_function — Serverless function (Gen 2)google_app_engine_application — App Engine applicationgoogle_sql_database_instance — Relational databasegoogle_spanner_instance — Globally-distributed relational databasegoogle_firestore_database — Document databasegoogle_bigtable_instance — Wide-column NoSQL databasegoogle_redis_instance — In-memory cachegoogle_storage_bucket — Object storagegoogle_filestore_instance — Managed NFS file storagegoogle_bigquery_dataset — Data warehousegoogle_pubsub_topic — Message queuegoogle_cloud_tasks_queue — Task queuegoogle_compute_network — Virtual network (VPC — primary because it defines topology)google_compute_security_policy — Web application firewall (Cloud Armor)google_dns_managed_zone — DNS zonegoogle_monitoring_alert_policy — Alert policymodule.* — Terraform module that wraps primary resources (tier inferred from wrapped resource)Action: Mark as PRIMARY with assigned tier. Classification done. No secondary_role.
Match resource type against secondary classification table. Each match assigns a secondary_role:
google_service_account — Workload identitydata.google_service_account — Data source reference to existing service accountgoogle_*_iam_member — IAM binding (all variants: project, cloud_run_service, storage_bucket, etc.)google_*_iam_policy — IAM policy (all variants)google_vpc_access_connector — VPC connector for serverlessgoogle_compute_subnetwork — Subnetgoogle_compute_firewall — Firewall rulegoogle_compute_router — Cloud routergoogle_compute_router_nat — NAT rulegoogle_compute_global_address — Global IP address (for VPC peering, load balancing)google_service_networking_connection — VPC peeringgoogle_sql_database — SQL schemagoogle_sql_user — SQL usergoogle_spanner_database — Spanner database schemagoogle_secret_manager_secret — Secret vaultgoogle_secret_manager_secret_version — Secret valuegoogle_dns_record_set — DNS recordgoogle_monitoring_notification_channel — Alert notification targetgoogle_app_engine_standard_app_version — App Engine service/version. Config source for the parent google_app_engine_application, carrying runtime, instance_class, env_variables, and scaling — the data the EB mapping needs. Note: these resources do not reference the parent by ID (link is the shared project), so serves[] may be empty and they may cluster separately; the App Engine fan-out step in phases/design/design-infra.md locates them by scanning the full inventory. Not excluded from discovery (they are classified and clustered here); they are a design-phase Skip Mapping (no standalone AWS target) — see design-refs/fast-path.md.google_app_engine_flexible_app_version — App Engine Flexible service/version (config source for the parent; same handling as the standard variant)google_kms_crypto_key — KMS encryption keygoogle_kms_key_ring — KMS key ringnull_resource — Terraform orchestration markertime_sleep — Orchestration delaygoogle_project_service — API service enablement (prerequisite, not a deployable unit)Action: Mark as SECONDARY with assigned role.
If resource type not in Priority 1 or 2, apply these deterministic fallback heuristics BEFORE free-form LLM reasoning:
| Pattern | Classification | secondary_role | confidence |
|---|---|---|---|
Name contains scheduler, task, job, workflow | SECONDARY | orchestration | 0.65 |
Name contains log, metric, alert, dashboard | SECONDARY | configuration | 0.60 |
| Resource has zero references to/from other resources | SECONDARY | configuration | 0.50 |
Resource only referenced by a module block | SECONDARY | configuration | 0.55 |
Type contains policy or binding | SECONDARY | access_control | 0.65 |
Type contains network or subnet | SECONDARY | network_path | 0.60 |
| None of the above match | Use LLM reasoning | — | 0.50-0.75 |
If still uncertain after heuristics, use LLM reasoning. Mark with:
classification_source: "llm_inference"confidence: 0.5-0.75Default: If all heuristics and LLM fail: SECONDARY / configuration with confidence 0.5. It is safer to under-classify (secondary) than over-classify (primary), because secondaries are grouped into existing clusters while primaries create new clusters.
For SECONDARY resources, populate serves[] array (list of PRIMARY resources it supports):
field = resource_type.name.id patternsExample: google_compute_firewall → references google_compute_network (SECONDARY) → serves google_compute_instance.web (PRIMARY)
Serves array: Points back to PRIMARY workloads affected by this firewall rule. Trace through SECONDARY resources until a PRIMARY is reached.