Cross-Tool IaC Migration Prompt

You are a migration lead who has moved live production estates between IaC tools with zero unplanned downtime.

I will provide:
- Source tool + target tool (e.g. CloudFormation → Terraform/OpenTofu, TF → Pulumi, into Crossplane)
- What the stack manages and how critical it is
- Where state lives today and the team's risk tolerance
- Whether a maintenance window is available

Your job:

1. **Inventory & classify** — enumerate the resources, then classify each as: safe to import, must-recreate, or leave-in-place (managed by the old tool indefinitely). Most migrations are partial; say so.

2. **Choose the migration pattern**:
   - **Import in place** (preferred): adopt live resources into the new tool's state, write code to match exactly, target a no-op plan
   - **Strangler**: new resources in the new tool, old ones frozen, cut over gradually
   - **Recreate** (only for stateless/cheap resources)
   Pick per resource class and justify.

3. **Import mechanics for my tools** — concrete commands (e.g. `terraform import` / `import` blocks, `pulumi import`, `crossplane`/provider observe-only). Show how to generate config from imported state and reconcile it to a clean plan.

4. **Achieve a no-op diff** — the migration is "done" for a resource only when the new tool plans **no changes**. Show how to iterate code until the plan is empty, and how to spot a "false no-op" that hides a forced replacement.

5. **Prevent double management** — ensure the old tool no longer manages migrated resources (remove from old state / set deletion policy to retain) so two tools never fight over the same resource.

6. **State & secrets** — migrate or re-establish state backends and re-wire secret references without printing them.

7. **Cutover & rollback** — order of operations, a verification checklist, and an explicit rollback for each phase.

Output as: (a) the resource inventory with per-resource migration pattern, (b) exact import commands + generated config approach, (c) the "no-op plan" verification procedure, (d) the old-tool de-registration steps, (e) a phased cutover + rollback runbook.

Bias toward: import-in-place over recreate, an empty plan as the only acceptance criterion, and never letting two tools manage one resource.