terraform-aws-modules/terraform-aws-ec2-instance examples/complete (tag v6.4.0), the most-downloaded module on the registry; absent from the measurement set until 2026-08-23
Source: https://github.com/terraform-aws-modules/terraform-aws-ec2-instance.git at v6.4.0.
Set: core. Lane: terraform-popular.
Why it is in the core set: a most-downloaded terraform-aws-modules example, pinned by tag; the shape most people deploy
Clear. Every active stage passes.
| Stage | Verdict | Detail |
|---|---|---|
| Cold deploy | pass | 35 resources added across 13 types (aws_instance, aws_eip, aws_iam_role/instance_profile/role_policy_attachment, aws_ebs_volume, aws_volume_attachment, aws_security_group x2, aws_vpc_security_group_egress_rule x2, aws_security_group_rule x2, vpc/subnet/route*/igw/default_* from the vpc module), 0 objects carry tofu-estate before migration |
| Migrate | pass | 24 of 35 eligible (11 untaggable across 5 types - aws_iam_role_policy_attachment, aws_volume_attachment, aws_security_group_rule x2, aws_route, aws_route_table_association x6 - all resolved by provider identity schema), 24 stamped, 0 failed, 11 skipped; the IAM role policy attachment’s composite live id asserted by value; genuine no-op on the follow-up apply |
| Replan from nothing | pass | no resource change proposed, exactly 8 foreign objects (the instance’s own root volume + floci’s default-VPC bootstrap); instance tofu-address re-checked against EC2 |
| No-op apply | pass | genuine no-op (0 added, 0 changed, 0 destroyed); 24 objects before, 24 after, no state file |
| Drift and reconverge | pass | one object tampered, exactly 1 object proposed and applied (0 added, 1 changed, 0 destroyed), tag reconverged to “ex-complete” |
| Rename | pass | moved block: module.vpc renamed with zero churn (0 add, 15 change, 0 destroy), marker rewritten in place; live-mv: module.security_group’s security group renamed with zero churn, its two untaggable rules followed for free; stock oracle over the same two-object rename on cold_deploy’s own state also shows zero churn (0 add, 0 change, 0 destroy); both live ids unchanged, read via the AWS CLI |
| Remove a block | pass | choudoufu: deleting module.ec2_complete’s block proposed exactly 10 destroys (0 add, 0 change, 10 destroy), matching the stock oracle’s own count and applied cleanly; the instance is confirmed terminated and the tagged object count dropped, both via the AWS CLI, not through choudoufu’s own report; the next plan proposes no resource action; stock oracle on cold_deploy’s own state (D-REMOVE-ORACLE) also proposes exactly 10 destroys for the same module |
| Change count (planned) | not run | |
| Replace with create_before_destroy | pass | choudoufu: changing module.ec2_complete’s ForceNew ami argument proposed exactly one instance replace at the same declared address, cascading into the eip (updated in-place) and the volume attachment (also replaced, instance_id is ForceNew there too) - 2 to add, 1 to change, 2 to destroy, matching F-ORACLE’s own plan shape; applied cleanly; the old instance is confirmed terminated and the new instance carries the marker, both via the AWS CLI; the local record store’s record at the same address now names the new instance’s id, not the terminated one (i-68af9e891fdbea4f9 -> i-e249d7514c38653e1); the next plan proposes no resource action; BREAK=replace confirms a manufactured marker collision is reported loudly (“Two live resources claiming one slot”) rather than silently proposed as nothing. Scope note: this exercises OpenTofu’s default destroy-then-create ordering, not the create_before_destroy variant the stage’s Title names - see this section’s own header comment and corpus-sqs-basic’s matching one. |
| Crash between create and destroy (planned) | not run | |
| Teardown (planned) | not run | |
| Plan, review, apply (planned) | not run | |
| Greenfield apply | pass | 35 resources from nothing, matching stock’s own cold-deploy count; the instance’s markers verified via the AWS CLI; 35 records in the local record store including untaggable types; replan empty; the instance’s own shape (type/ami/block-device-count) matches stock’s cold deploy, via the AWS CLI on both endpoints, marker tags never compared; 24 objects carry the estate tag |
| Strict profile (planned) | not run |
Last run at commit df0cc6a075 on 2026-08-25T17:25:24Z, exit code 0.
Reproduce it#
go run ./tools/gauntlet run corpus-ec2-instance-completeNeeds Docker (the emulator is pulled at the pinned digest), the AWS CLI, and a
stock terraform or tofu binary on PATH for the cold deploy. The script is
live/e2e/corpus-ec2-instance-complete/run.sh; BREAK=1 corrupts its assertions to show they are load-bearing.