choudoufu

Your cloud already knows what you own.

choudoufu is OpenTofu that tags each resource with its owner. Your cloud's own permissions decide who can change it.

Start with AWS How it works

Adopt what already runs

Tag a resource and your configuration owns it. One command tags everything in an existing state file.

Use the permissions you have

An ordinary policy on the tag decides who can change a resource. Handing over an estate is granting a role.

The state file is a cache

Plans read your live resources and the tags on them. Delete the cache and the next plan gives the same answer.

Pick your platform

AWS proven Every headline stage passes on every core estate against the pinned emulator, and two estates have run on a real account.
Kubernetes coming soon Every object-metadata type plans, carries the estate label, is swept for orphans, and is fenced by one admission policy that reads it; the gauntlet runs its stages on a kind cluster in a lane of its own, where the first estate clears every applicable stage, migration from a stock state included (#1073).

What stands behind it

See one for yourself, with Docker and nothing else: just smoke import stands a stock estate up, deletes its state file, and plans it empty from markers alone. All of them take a minute to six.