Compatibility
llms.txtlists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.Show the whole prompt
Follow https://intentius.io/choudoufu/aws/compatibility/. Run `choudoufu live-check` here and report each refusal.
Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.choudoufu live-checkIt runs offline and names the fix for anything to change.
The live backend
Section titled “The live backend”The live backend in estate.chdf.hcl takes the place of the backend or cloud block.
Expansions and identity arguments
Section titled “Expansions and identity arguments”count and for_each work over data sources and over values the configuration states, such as variables and locals.
Resource types
Section titled “Resource types”Admitted AWS types plan, and READINESS.md lists each type’s tier.
Modules
Section titled “Modules”live-check, offline
Each example with a live block added, checked 2026-10-27 at 2850aa1d0e with hashicorp/aws 6.59.0.
| Module | Version | Example | Verdict | Reads | Refusals |
|---|---|---|---|---|---|
| acm | v6.3.1 | examples/complete-dns-validation | refused | 31 | Dynamic value in static context (43), Unable to compute static value (13), count-index (9), module-providers (1) |
| acm | v6.3.1 | examples/complete-dns-validation-with-cloudflare | refused | 0 | Module output not supported in static context (1), module-providers (1) |
| acm | v6.3.1 | examples/complete-email-validation | plans | 0 | |
| acm | v6.3.1 | examples/complete-email-validation-with-validation-domain | plans | 0 | |
| alb | v9.9.0 | examples/complete-alb | plans | 99 | |
| alb | v9.9.0 | examples/complete-nlb | plans | 98 | |
| alb | v9.9.0 | examples/mutual-auth-alb | plans | 98 | |
| apigateway-v2 | v6.1.1 | examples/complete-http | refused | 4 | markerless-type (3), for_each key cannot be recorded as a marker (2), moved-block (2), unadmitted-type (1) |
| apigateway-v2 | v6.1.1 | examples/vpc-link-http | refused | 95 | for_each key cannot be recorded as a marker (2), moved-block (1) |
| apigateway-v2 | v6.1.1 | examples/websocket | refused | 0 | for_each key cannot be recorded as a marker (4), markerless-type (1), moved-block (1) |
| appconfig | v2.0.2 | examples/appconfig-hosted | plans | 0 | |
| appconfig | v2.0.2 | examples/s3 | refused | 7 | Dynamic value in static context (1), Unable to compute static value (1) |
| appconfig | v2.0.2 | examples/ssm-document | refused | 0 | Non-static for_each expression (1), Two resources with the same identity (1) |
| appconfig | v2.0.2 | examples/ssm-parameter | refused | 0 | Non-static for_each expression (1) |
| appsync | v4.1.1 | examples/complete | refused | 3 | Dynamic value in static context (12), count-index (3), unadmitted-type (2), Identity not resolvable from configuration (1) |
| autoscaling | v9.3.0 | examples/complete | plans | 95 | |
| cloudfront | v6.7.1 | examples/complete | refused | 99 | Unable to compute static value (3), Module output not supported in static context (2), count-index (2) |
| cloudfront | v6.7.1 | examples/mtls | refused | 4 | Unable to compute static value (3), Module output not supported in static context (2), count-index (2) |
| cloudwatch | v5.7.3 | examples/cis-alarms | refused | 0 | Module output not supported in static context (28), Two resources with the same identity (28), Unable to compute static value (28), Identity not resolvable from configuration (15) |
| cloudwatch | v5.7.3 | examples/complete-log-metric-filter-and-alarm | plans | 0 | |
| cloudwatch | v5.7.3 | examples/composite-alarm | plans | 0 | |
| cloudwatch | v5.7.3 | examples/lambda-metric-alarm | plans | 0 | |
| cloudwatch | v5.7.3 | examples/log-account-policy | refused | 0 | Null identity argument (2) |
| cloudwatch | v5.7.3 | examples/log-anomaly-detector | plans | 0 | |
| cloudwatch | v5.7.3 | examples/log-group-with-data-protection-policy | plans | 0 | |
| cloudwatch | v5.7.3 | examples/log-group-with-log-stream | refused | 0 | Dynamic value in static context (3), Unable to compute static value (3) |
| cloudwatch | v5.7.3 | examples/log-subscription-filter | refused | 0 | Null identity argument (2) |
| cloudwatch | v5.7.3 | examples/metric-stream | plans | 0 | |
| cloudwatch | v5.7.3 | examples/multiple-lambda-metric-alarm | plans | 0 | |
| cloudwatch | v5.7.3 | examples/query-definition | plans | 0 | |
| dynamodb-table | v5.5.1 | examples/autoscaling | plans | 0 | |
| dynamodb-table | v5.5.1 | examples/basic | plans | 0 | |
| dynamodb-table | v5.5.1 | examples/global-tables | plans | 0 | |
| dynamodb-table | v5.5.1 | examples/s3-import | plans | 0 | |
| ec2-instance | v6.4.0 | examples/complete | refused | 95 | unadmitted-type (2), Unresolvable identity (1) |
| ec2-instance | v6.4.0 | examples/session-manager | plans | 28 | |
| ecr | v3.2.0 | examples/complete | refused | 0 | unadmitted-type (1) |
| ecr | v3.2.0 | examples/repository-template | refused | 0 | unadmitted-type (1) |
| ecs | v7.6.0 | examples/complete | refused | 95 | child-module (3), Non-static for_each expression (1) |
| ecs | v7.6.0 | examples/container-definition | plans | 0 | |
| ecs | v7.6.0 | examples/ec2-autoscaling | plans | 97 | |
| ecs | v7.6.0 | examples/express-service | plans | 96 | |
| ecs | v7.6.0 | examples/fargate | plans | 96 | |
| ecs | v7.6.0 | examples/managed-instances | plans | 95 | |
| eks-pod-identity | v2.10.0 | examples/complete | refused | 55 | moved-block (16), unadmitted-type (2) |
| eks | v21.29.0 | examples/eks-auto-mode | refused | 158 | moved-block (24), unadmitted-type (2) |
| eks | v21.29.0 | examples/eks-capabilities | refused | 137 | moved-block (8), unadmitted-type (1) |
| eks | v21.29.0 | examples/eks-hybrid-nodes | refused | 228 | moved-block (8), Module output not supported in static context (4), unadmitted-type (4), Non-static for_each expression (3), Unable to compute static value (3) |
| eks | v21.29.0 | examples/eks-managed-node-group | refused | 139 | moved-block (16), Data source not readable before resolution (6), Identity not resolvable from configuration (2), unadmitted-type (2) |
| eks | v21.29.0 | examples/karpenter | refused | 134 | moved-block (18), Data source not readable before resolution (3), unadmitted-type (2), Identity not resolvable from configuration (1) |
| eks | v21.29.0 | examples/self-managed-node-group | refused | 139 | moved-block (16), Data source not readable before resolution (6), unadmitted-type (2) |
| eventbridge | v4.3.3 | examples/api-gateway-event-source | refused | 0 | Module output not supported in static context (1), Unable to compute static value (1), markerless-type (1), unadmitted-type (1) |
| eventbridge | v4.3.3 | examples/complete | refused | 0 | Null identity argument (10), unadmitted-type (10), Unable to compute static value (3), Dynamic value in static context (2), child-module (2), Non-static for_each expression (1) |
| eventbridge | v4.3.3 | examples/default-bus | refused | 0 | Null identity argument (1) |
| eventbridge | v4.3.3 | examples/with-api-destination | refused | 0 | Null identity argument (3), unadmitted-type (1) |
| eventbridge | v4.3.3 | examples/with-archive | plans | 0 | |
| eventbridge | v4.3.3 | examples/with-bus-logging | refused | 0 | Dynamic value in static context (2), Unable to compute static value (2) |
| eventbridge | v4.3.3 | examples/with-ecs-scheduling | refused | 0 | Unable to compute static value (2), child-module (2), Dynamic value in static context (1), Non-static for_each expression (1), Null identity argument (1), unadmitted-type (1) |
| eventbridge | v4.3.3 | examples/with-lambda-scheduling | refused | 0 | Null identity argument (1) |
| eventbridge | v4.3.3 | examples/with-permissions | plans | 0 | |
| eventbridge | v4.3.3 | examples/with-pipes | refused | 0 | Dynamic value in static context (9), Unable to compute static value (4), Module output not supported in static context (1) |
| eventbridge | v4.3.3 | examples/with-schedules | refused | 0 | Identity not resolvable from configuration (3), unadmitted-type (1) |
| iam | v6.8.0 | examples/iam-account | plans | 0 | |
| iam | v6.8.0 | examples/iam-group | refused | 0 | markerless-type (1) |
| iam | v6.8.0 | examples/iam-oidc-provider | plans | 0 | |
| iam | v6.8.0 | examples/iam-policy | plans | 0 | |
| iam | v6.8.0 | examples/iam-read-only-policy | plans | 0 | |
| iam | v6.8.0 | examples/iam-role | refused | 0 | Dynamic value in static context (3), Unable to compute static value (3) |
| iam | v6.8.0 | examples/iam-role-for-service-accounts | refused | 783 | Unable to compute static value (80), moved-block (8), Data source not readable before resolution (5), Identity not resolvable from configuration (1), unadmitted-type (1) |
| iam | v6.8.0 | examples/iam-user | refused | 0 | unadmitted-type (1) |
| key-pair | v3.0.1 | examples/complete | plans | 0 | |
| kms | v4.2.2 | examples/complete | refused | 0 | markerless-type (3), Null identity argument (1), unadmitted-type (1) |
| lambda | v8.8.1 | examples/alias | refused | 0 | Dynamic value in static context (8), Data source not readable before resolution (4), Identity not resolvable from configuration (4), Unable to compute static value (4), unadmitted-type (2), Null identity argument (1) |
| lambda | v8.8.1 | examples/async | refused | 0 | Null identity argument (1) |
| lambda | v8.8.1 | examples/build-package | plans | 0 | |
| lambda | v8.8.1 | examples/code-signing | refused | 0 | Non-static identity argument (2), unadmitted-type (1) |
| lambda | v8.8.1 | examples/complete | refused | 20 | unadmitted-type (1) |
| lambda | v8.8.1 | examples/container-image | refused | 0 | unadmitted-type (6) |
| lambda | v8.8.1 | examples/deploy | refused | 1 | unadmitted-type (1) |
| lambda | v8.8.1 | examples/event-source-mapping | refused | 50 | unadmitted-type (1) |
| lambda | v8.8.1 | examples/multiple-regions | plans | 0 | |
| lambda | v8.8.1 | examples/runtimes | refused | 0 | unadmitted-type (3) |
| lambda | v8.8.1 | examples/simple | plans | 0 | |
| lambda | v8.8.1 | examples/simple-cicd | plans | 0 | |
| lambda | v8.8.1 | examples/triggers | plans | 0 | |
| lambda | v8.8.1 | examples/with-efs | plans | 0 | |
| lambda | v8.8.1 | examples/with-vpc | plans | 0 | |
| lambda | v8.8.1 | examples/with-vpc-s3-endpoint | refused | 3 | Non-static identity argument (2), Module output not supported in static context (1), markerless-type (1) |
| rds-aurora | v10.4.1 | examples/autoscaling | plans | 127 | |
| rds-aurora | v10.4.1 | examples/dsql | refused | 0 | unadmitted-type (3) |
| rds-aurora | v10.4.1 | examples/global-cluster | plans | 252 | |
| rds-aurora | v10.4.1 | examples/limitless | plans | 127 | |
| rds-aurora | v10.4.1 | examples/multi-az | refused | 126 | Identity not resolvable from configuration (1) |
| rds-aurora | v10.4.1 | examples/mysql | refused | 126 | Identity not resolvable from configuration (1), unadmitted-type (1) |
| rds-aurora | v10.4.1 | examples/postgresql | refused | 127 | unadmitted-type (1) |
| rds-aurora | v10.4.1 | examples/s3-import | plans | 126 | |
| rds-aurora | v10.4.1 | examples/serverless | plans | 128 | |
| rds-proxy | v4.4.0 | examples/mysql-iam-cluster | refused | 126 | Module output not supported in static context (2), Unable to compute static value (2), unadmitted-type (1) |
| rds-proxy | v4.4.0 | examples/mysql-iam-instance | refused | 126 | Module output not supported in static context (3), Unable to compute static value (3), unadmitted-type (2) |
| rds-proxy | v4.4.0 | examples/postgresql-iam-cluster | refused | 126 | Module output not supported in static context (2), Unable to compute static value (2), unadmitted-type (1) |
| rds-proxy | v4.4.0 | examples/postgresql-iam-instance | refused | 126 | Module output not supported in static context (3), Unable to compute static value (3), unadmitted-type (2) |
| rds | v7.2.1 | examples/blue-green-deployment | plans | 126 | |
| rds | v7.2.1 | examples/complete-mssql | refused | 127 | unadmitted-type (2), Dynamic value in static context (1), Unable to compute static value (1) |
| rds | v7.2.1 | examples/complete-mysql | plans | 127 | |
| rds | v7.2.1 | examples/complete-oracle | refused | 127 | unadmitted-type (1) |
| rds | v7.2.1 | examples/complete-postgres | refused | 127 | Identity not resolvable from configuration (1), unadmitted-type (1) |
| rds | v7.2.1 | examples/cross-region-replica-postgres | refused | 0 | count-index (4) |
| rds | v7.2.1 | examples/enhanced-monitoring | plans | 127 | |
| rds | v7.2.1 | examples/groups | plans | 0 | |
| rds | v7.2.1 | examples/replica-mysql | plans | 126 | |
| rds | v7.2.1 | examples/replica-postgres | plans | 126 | |
| rds | v7.2.1 | examples/role-association-postgres | refused | 177 | Dynamic value in static context (1), Module output not supported in static context (1), Unable to compute static value (1) |
| rds | v7.2.1 | examples/s3-import-mysql | refused | 126 | Identity argument not set (2) |
| route53 | v6.5.1 | examples/complete | refused | 106 | Unable to compute static value (13), Identity not resolvable from configuration (12), Dynamic value in static context (11), Module output not supported in static context (2), Unresolvable identity (1) |
| route53 | v6.5.1 | examples/cross-account | plans | 111 | |
| s3-bucket | v5.9.1 | examples/account-public-access | plans | 0 | |
| s3-bucket | v5.9.1 | examples/complete | refused | 4 | Unable to compute static value (4) |
| s3-bucket | v5.9.1 | examples/directory-bucket | plans | 5 | |
| s3-bucket | v5.9.1 | examples/notification | refused | 0 | Identity not resolvable from configuration (2) |
| s3-bucket | v5.9.1 | examples/object | plans | 0 | |
| s3-bucket | v5.9.1 | examples/s3-analytics | plans | 0 | |
| s3-bucket | v5.9.1 | examples/s3-inventory | refused | 0 | Identity not resolvable from configuration (1) |
| s3-bucket | v5.9.1 | examples/s3-replication | refused | 0 | unadmitted-type (1) |
| s3-bucket | v5.9.1 | examples/table-bucket | refused | 0 | unadmitted-type (3) |
| secrets-manager | v2.2.0 | examples/complete | refused | 0 | unadmitted-type (2) |
| security-group | v6.0.0 | examples/complete | plans | 74 | |
| sns | v7.2.0 | examples/complete | plans | 0 | |
| sqs | v5.2.2 | examples/complete | plans | 0 | |
| ssm-parameter | v2.1.2 | examples/complete | refused | 0 | Dynamic value in static context (72), Unable to compute static value (48) |
| step-functions | v5.1.1 | examples/complete | refused | 0 | unadmitted-type (6), Unresolvable identity (2), Dynamic value in static context (1), Unable to compute static value (1) |
| vpc | v6.6.1 | examples/block-public-access | plans | 37 | |
| vpc | v6.6.1 | examples/complete | plans | 211 | |
| vpc | v6.6.1 | examples/flow-log | plans | 95 | |
| vpc | v6.6.1 | examples/ipam | refused | 6 | Unable to compute static value (70), Dynamic value in static context (19), unadmitted-type (1) |
| vpc | v6.6.1 | examples/ipv6-dualstack | plans | 260 | |
| vpc | v6.6.1 | examples/ipv6-only | plans | 0 | |
| vpc | v6.6.1 | examples/issues | refused | 0 | Identity not resolvable from configuration (5), count-index (5) |
| vpc | v6.6.1 | examples/manage-default-vpc | refused | 0 | unadmitted-type (1) |
| vpc | v6.6.1 | examples/network-acls | plans | 203 | |
| vpc | v6.6.1 | examples/outpost | refused | 131 | count-index (2) |
| vpc | v6.6.1 | examples/secondary-cidr-blocks | plans | 123 | |
| vpc | v6.6.1 | examples/separate-route-tables | plans | 238 | |
| vpc | v6.6.1 | examples/simple | plans | 37 |
Running it
Section titled “Running it”plan -out, apply <planfile> and -target work.
Other providers
Section titled “Other providers”A type plans when configuration resolves its identity. The full list is COMPATIBILITY.md.