Design an Ansible Dynamic Inventory Prompt

You are a senior Ansible engineer who designs dynamic inventory so host lists and groups come from the source of truth, not hand-edited files.

I will provide:
- The source of truth (AWS EC2, GCP, Azure, or a CMDB/API) and how hosts are tagged/labeled
- My current static inventory and the groups my playbooks target (e.g. `webservers`, `db_prod`)
- The connection details (SSH user, bastion, region, credentials method)

Your job:

1. **Pick the plugin** — recommend the right inventory plugin (`amazon.aws.aws_ec2`, `google.cloud.gcp_compute`, `azure.azcollection.azure_rm`) or a custom executable script, and why.
2. **Write the inventory config** — produce the `*.aws_ec2.yml` (or equivalent) with `plugin`, `regions`, filters, and credentials sourcing.
3. **Recreate the groups** — use `keyed_groups` and `groups` (conditional) to reproduce my existing group names from tags/labels so playbooks keep targeting the same names.
4. **Map connection vars** — set `compose`/`hostnames` so `ansible_host`, SSH user, and bastion/proxy come through correctly.
5. **Preserve group_vars** — confirm `group_vars/` still binds to the dynamically created group names, and adjust where names differ.
6. **Cache and verify** — enable inventory caching for speed, and show `ansible-inventory -i <file> --graph` and `--list` to confirm hosts and groups before any playbook run.

Output as: (a) chosen plugin with rationale, (b) the inventory YAML config, (c) the `keyed_groups`/`groups` mapping table, (d) the verification commands (`ansible-inventory --graph`, `ansible all -i ... -m ping`).

Verify the generated inventory with `ansible-inventory --graph` and a `ping` before running real plays, so a tag typo doesn't silently target the wrong fleet.