Setting the file. One moment.
Subchapter 27.67
references/shared/schema-discover-iac.mdMarkdown11 KBView on GitHub
Schemas for gcp-resource-inventory.json and gcp-resource-clusters.json, produced by discover-iac.md.
Convention: Values shown as X|Y in examples indicate allowed alternatives — use exactly one value per field, not the literal pipe character.
Complete inventory of discovered GCP resources with classification, dependencies, and AI detection.
{
"metadata": {
"report_date": "2026-02-26",
"project_directory": "/path/to/terraform",
"terraform_version": ">= 1.0.0"
},
"summary": {
"total_resources": 50,
"primary_resources": 12,
"secondary_resources": 38,
"total_clusters": 6,
"classification_coverage": "100%"
},
"resources": [
{
"address": "google_cloud_run_service.orders_api",
"type": "google_cloud_run_service",
"name": "orders_api",
"classification": "PRIMARY",
"tier": "compute",
"confidence": 0.99,
"config": {
"timeout": 60,
"memory_mb": 512,
"concurrency": 100
},
"depth": 3,
"cluster_id": "compute_cloudrun_us-central1_001"
},
{
"address": "google_service_account.app",
"type": "google_service_account",
"name": "app",
"classification": "SECONDARY",
"tier": "identity",
"confidence": 0.99,
"secondary_role": "identity",
"serves": ["google_cloud_run_service.orders_api", "google_cloud_run_service.products_api"],
"config": {
"account_id": "app-sa"
},
"depth": 2,
"cluster_id": "compute_cloudrun_us-central1_001"
},
{
"address": "google_app_engine_standard_app_version.default_v1",
"type": "google_app_engine_standard_app_version",
"name": "default_v1",
"classification": "SECONDARY",
"tier": "compute",
"confidence": 0.99,
"secondary_role": "configuration",
"serves": [],
"config": {
"service": "default",
"version_id": "v1",
"runtime": "python312",
"instance_class": "F2",
"serving_status": "SERVING",
"project": "my-gcp-project",
"automatic_scaling": {
"standard_scheduler_settings": { "min_instances": 2, "max_instances": 10 }
}
},
"depth": 1,
"cluster_id": "compute_appengine_us-central1_001"
},
{
"address": "google_compute_network.main",
"type": "google_compute_network",
"name": "main",
"classification": "PRIMARY",
"tier": "networking",
"confidence": 0.99,
"config": {
"auto_create_subnetworks": false
},
"depth": 0,
"cluster_id": "networking_vpc_us-central1_001"
}
],
"ai_detection": {
"has_ai_workload": false,
"confidence": 0,
"confidence_level": "none",
"signals_found": [],
"ai_services": []
}
}CRITICAL Field Names (use EXACTLY these keys):
address — Terraform resource address (NOT id, resource_address)type — Resource type (NOT resource_type)name — Resource name component (NOT resource_name)classification — "PRIMARY" or "SECONDARY" (NOT class, category)tier — Infrastructure layer: compute, database, storage, networking, identity, messaging, monitoring (NOT layer)confidence — Classification confidence 0.0-1.0 (NOT certainty)secondary_role — For secondaries only: identity, access_control, network_path, configuration, encryption, orchestrationserves — For secondaries only: array of primary resource addresses serveddepth — Dependency depth (0 = foundational, N = depends on depth N-1)cluster_id — Which cluster this resource belongs toCanonical config keys for google_sql_database_instance (Clarify Step 2 auto-extraction reads these — use EXACTLY these keys; do not write disk_size or a gcp_config object):
config.disk_size_gb — allocated disk in GB, normalized from Terraform settings.disk_size. Omit when not set in Terraform.config.disk_autoresize — boolean, from Terraform settings.disk_autoresize, ONLY when explicitly set in HCL. Omit when not set — the provider default is true, but an omitted attribute is not evidence the author chose it, so do not synthesize the default. (Generate’s disk-size cross-check treats explicit false as a hard allocation cap and explicit true as growth-possible; absent = unknown.)config.availability_type — "ZONAL" or "REGIONAL". Omit when not set.config.tier — Cloud SQL machine tier (e.g. "db-f1-micro").config.database_version — engine version string (e.g. "POSTGRES_15").Example:
{
"address": "google_sql_database_instance.db",
"type": "google_sql_database_instance",
"name": "db",
"classification": "PRIMARY",
"tier": "database",
"confidence": 0.99,
"config": {
"disk_size_gb": 10,
"availability_type": "ZONAL",
"tier": "db-f1-micro",
"database_version": "POSTGRES_15"
},
"depth": 1,
"cluster_id": "database_sql_us-central1_001"
}Key Sections:
metadata — Report metadata (report_date, project_directory, terraform_version)summary — Aggregate statistics (total_resources, primary/secondary counts, cluster count, classification_coverage)resources[] — All discovered resources with fields aboveai_detection — AI workload detection results:
has_ai_workload — booleanconfidence — 0.0-1.0confidence_level — “very_high” (90%+), “high” (70-89%), “medium” (50-69%), “low” (< 50%), “none” (0%)signals_found[] — array of detection signals with method, pattern, confidence, evidenceai_services[] — list of AI services detected (vertex_ai, bigquery_ml, etc.)Live gcloud discovery produces the same inventory/cluster schemas with these additions:
metadata additional fields:
discovery_sources — string[]: which sources produced data, e.g. ["live"] or ["terraform", "live"]. terraform_version may be null on live-only runs.clustering_mode — "simplified" (IaC Step 3S; also used for merged IaC+live runs), "simplified_live" (live-only runs), or absent (full IaC clustering).resources[] optional fields:
source — "terraform", "live", or "live+terraform" (merged entry)unmanaged_by_terraform — true when live discovery found the resource but no Terraform manages it (click-ops drift)not_found_live — true when Terraform declares the resource but the (successful) live capture did not find it deployedTop-level live_metadata section:
{
"live_metadata": {
"found": true,
"captured_at": "2026-07-20T18:20:00Z",
"project": "acme-prod",
"method": "asset_search",
"cai_enable_offered": false,
"cai_enable_accepted": null,
"capture_warnings": [],
"unmapped_asset_types": {},
"drift": {
"resources_live_only": 0,
"resources_terraform_only": 0,
"config_conflicts": [
{
"address": "google_sql_database_instance.db",
"field": "settings.tier",
"terraform_value": "db-f1-micro",
"live_value": "db-custom-2-8192"
}
]
}
}
}drift is present only when Terraform AND live discovery both produced resources. Env var and secret VALUES must never appear anywhere in the inventory — names only, with discover-iac.md Step 0 redaction patterns applied.
Resources grouped into logical clusters for migration with full dependency graph and creation order.
{
"clusters": [
{
"cluster_id": "networking_vpc_us-central1_001",
"gcp_region": "us-central1",
"primary_resources": [
"google_compute_network.main"
],
"secondary_resources": [
"google_compute_subnetwork.app",
"google_compute_firewall.app"
],
"network": null,
"creation_order_depth": 0,
"must_migrate_together": true,
"dependencies": [],
"edges": []
},
{
"cluster_id": "database_sql_us-central1_001",
"gcp_region": "us-central1",
"primary_resources": [
"google_sql_database_instance.db"
],
"secondary_resources": [
"google_sql_database.main"
],
"network": "networking_vpc_us-central1_001",
"creation_order_depth": 1,
"must_migrate_together": true,
"dependencies": ["networking_vpc_us-central1_001"],
"edges": [
{
"from": "google_sql_database_instance.db",
"to": "google_compute_network.main",
"relationship_type": "network_membership",
"evidence": {
"field_path": "settings.ip_configuration.private_network",
"reference": "VPC membership"
}
}
]
},
{
"cluster_id": "compute_cloudrun_us-central1_001",
"gcp_region": "us-central1",
"primary_resources": [
"google_cloud_run_service.orders_api",
"google_cloud_run_service.products_api"
],
"secondary_resources": [
"google_service_account.app"
],
"network": "networking_vpc_us-central1_001",
"creation_order_depth": 2,
"must_migrate_together": true,
"dependencies": ["database_sql_us-central1_001"],
"edges": [
{
"from": "google_cloud_run_service.orders_api",
"to": "google_sql_database_instance.db",
"relationship_type": "data_dependency",
"evidence": {
"field_path": "template.spec.containers[0].env[].value",
"reference": "DATABASE_URL"
}
}
]
}
],
"creation_order": [
{ "depth": 0, "clusters": ["networking_vpc_us-central1_001"] },
{ "depth": 1, "clusters": ["database_sql_us-central1_001"] },
{ "depth": 2, "clusters": ["compute_cloudrun_us-central1_001"] }
]
}Key Fields:
cluster_id — Unique cluster identifier (deterministic format: {service_category}_{service_type}_{gcp_region}_{sequence})gcp_region — GCP region for this clusterprimary_resources — GCP resources that map independentlysecondary_resources — GCP resources that support primary resourcesnetwork — Which VPC cluster this cluster belongs to (cluster ID reference, or null if networking cluster itself)creation_order_depth — Depth level in topological sort (0 = foundational)must_migrate_together — Boolean indicating if cluster is an atomic deployment unitdependencies — Other cluster IDs this cluster depends on (derived from cross-cluster Primary->Primary edges)edges — Typed relationships between resources with structured evidencecreation_order — Global ordering of clusters by depth level (for migration sequencing)