About

Every infrastructure tool outside Kubernetes keeps a private ledger of what it owns, and that ledger is where the permission boundary, the secrets and the lock end up. Both tools here put the record where IAM can read it instead.

choudoufu is the smallest change to OpenTofu that does this for AWS. chant goes the other way, into the platform’s own spec. Neither has a pricing page.

The thinking is on the blog.