Add Resources from approved modules#

A Resource is one configured instance of an approved Terraform module version inside a Deployment. The module schema creates the guided form and validates input before Plan.

Navigate: Provisioning → Deployments → select a Deployment → Resources.

Before you start#

Confirm that:

Runner & state is ready;
the required cloud Connection and alias is attached to the Deployment;
an approved module version exists for the provider;
the selected cloud identity can create the intended object in its target scope.

Pending, rejected and revoked versions cannot be selected for a new Resource.

Create a Resource#

Select Create resource.

1. Select the module version#

Choose the module and an approved semantic version. The version is pinned to an exact repository commit, input schema and provider locks.

Do not choose a version only because it is the newest. Open it in Module registry to review its code link, schema and validation evidence when the change is sensitive.

2. Choose the target#

Enter the Resource name and region, then select a Connection alias. The alias decides which subscription, account or project receives the Resource.

For a multi-cloud Deployment, verify the provider badge and alias together.

3. Complete the guided form#

The remaining fields come from the approved schema.json:

required fields are marked and validated before save;
descriptions explain the expected value;
enumerations appear as selections;
numbers, strings, objects and lists use the matching input control;
defaults come from the approved schema.

Use JSON view only when you already have valid structured input. The guided form is the recommended path.

Select Create resource, or Save changes when editing. The Resource becomes Draft; no pipeline starts and no cloud change occurs.

Reference another Resource#

A compatible reference field can offer up to three input modes:

Mode	Use it for	What Reply CMP stores
In deployment	An output from another Resource in the same Deployment.	A typed reference to the source Resource and output.
Discovered	An existing compatible cloud object already visible in Discovery.	The selected object identifier or schema-defined value.
Manual	A literal value or an object that cannot be discovered.	The value you enter.

Choose In deployment when, for example, a Storage Account needs the Resource Group created by another Resource. Select the source Resource and its compatible output. Reply CMP generates the Terraform expression and dependency, so both Resources are planned in the correct order; it does not copy the source output’s current display value into the form.

Choose Discovered when the dependency already exists outside this Deployment, such as a subnet found by Discovery. Review the Connection and provider before selecting it, especially when the Deployment has several aliases.

The selector appears only when the approved module schema declares compatible Reply CMP reference metadata. Existing modules remain compatible: their fields continue to use Manual input until a new reviewed schema version adds that metadata.

Plan the Deployment#

Plan includes every active Resource and pending deletion in the Deployment. Review:

create, update, replacement and delete counts;
the exact runner and state shown before dispatch;
Connection aliases and target providers;
policy results and warnings;
the external pipeline or workflow logs.

If anything is unexpected, edit the Resource and create a new Plan.

Apply and verify#

Start Apply only after the current Plan is understood. The customer runner creates a fresh plan, passes guardrail evaluation and applies that same saved binary.

After success:

changed Resources become Latest;
the Deployment becomes Valid, or Ready for removal when no Resources remain;
the external-run link and immutable evidence remain in Operations.

Change one Resource to another module version#

Module approval never upgrades existing Resources automatically.

Open the Resource.
Select Change module version.
Choose an approved target version.
Review its read-only schema and version evidence.
Complete any newly required input. Compatible existing values are carried forward.
Save. Only this Resource becomes Draft.
Run Plan and pay particular attention to replacements and deletes.

Repeat this action only for other Resources that should be upgraded.

Use multiple clouds and aliases#

One Deployment can contain Resources for Azure, AWS and GCP and can connect to several accounts for one provider.

Resource	Provider	Alias	Example target
`app-storage`	Azure	`default`	Application subscription
`audit-storage`	Azure	`security`	Security subscription
`archive-bucket`	AWS	`archive`	Archive account
`analytics-bucket`	GCP	`data`	Data project

All Resources still share one operation and state lifecycle. Test a new multi-cloud or multi-alias topology outside production first and verify every provider target in Plan.

Delete a Resource#

Open the Resource menu and select Delete. This schedules destruction. Run Plan, review the delete and dependent changes, then Apply. The record reflects the deletion only after the operation completes.