choudoufu #

OpenTofu with one permission model.

Each resource carries its own ownership record as ordinary cloud tags. AWS can tell you what an estate contains, and your IAM already decides who may read or change it. Nothing else to permission, and no lock to manage. Experimental, AWS only.

A fork of OpenTofu.

Three things have to survive between runs#

Identity. Pure IAM. Who may change which resource is a policy you already know how to write.

Values. Resources AWS has no object for. null_resource, random_pet, time_static.

Effects. A database migration that ran. The plan shows it coming before anything fires.

Why they are separate, and what it changes.

• How to stop a staging role reaching production. The mistake fails at the cloud, not at review.
• How to cover every team with one policy. A new team costs a session tag, not a policy.
• How to deny creating anything unowned. Ownership becomes a precondition of existing.
• Nothing to lock. Concurrent runs settle at the API.

The policies that do these, and where AWS honours the condition they rest on.

How far it goes#

Core is a fixed, representative set — the terraform-aws-modules examples most people actually deploy, plus real OpenTofu-native projects, plus one plain reference estate — pinned by tag, meant to reach 100%. All adds every other real estate as it’s crossed, with no pin and no target.

Check yours#

choudoufu live-check

In your config directory. No credentials.

Docs#

The model, governance, and using it — or start at the full docs index.

Experimental. AWS only. Built on OpenTofu 1.13.0 from fork point 03743ce6e8. Plain OpenTofu is documented at opentofu.org.

choudoufu is an independent fork. It is not affiliated with or endorsed by OpenTofu or the Linux Foundation. OpenTofu is a registered trademark of the Linux Foundation. Code is licensed MPL-2.0. Upstream source lives at github.com/opentofu/opentofu and all stock docs at opentofu.org/docs.