Identity
A marker is an ownership record carried on the resource itself, in whatever the platform lets anyone select on. It is written as part of the create call, so a resource that exists carries one. The next plan reads it back live; any tool that can read the marker can list an estate, and any tool that can write one can adopt a resource, with no dependency on this fork.
Two paths back from a live object, decided by who chose the identity. Where the configuration named it, the marker confirms ownership. Where the platform assigned it, the marker is the only way back, and that is why an identity has to be settleable before the marker is written.
| Platform | Where a resource's identity lives |
|---|---|
| AWS | Two resource tags, tofu-estate and tofu-address, written on the create call. About half the provider’s types have no tag surface; those derive their identity from configuration or hold it in the record store. |
| Kubernetes | One label, tofu-estate, written on the create; the object is re-bound through group, kind, namespace and name. A label value is capped at 63 characters and cannot carry a config address, so the address stays off the object. generateName is refused. |
A resource with no marker surface is not unidentifiable. An attachment is the two things it attaches; a record is a role name and a policy name. Those recompute from configuration on every run and need no carrier at all.