choudoufu and the Terraform state file
Same HCL, same providers, same plan. Ownership moves onto the resource.
A state file does three jobs. It says which live resource an address refers to, holds values the cloud cannot, and records that an effect happened. choudoufu takes them apart, and the state file becomes a cache you may lose.
Everything else is stock OpenTofu, measured on 26 real configurations by the gauntlet.
terraform.tfstate | under choudoufu | |
|---|---|---|
| The permission unit | one file | one resource |
| To narrow access | split the state | write a policy |
| Handover | export, migrate, re-import | grant a role |
| A rename | state mv | rewrite a tag |
| A crashed apply | an orphan | a resource the next plan finds |
| Two runs at once | a lock | the cloud’s uniqueness constraint |
The claims
Twenty of them, each a scenario that runs in a few minutes. Every one also runs inverted, so a check that cannot fail gets caught. Staleness costs reads and never results. Recovery is a re-run rather than surgery. The tag is the boundary, enforced by AWS rather than by the tool. Run them yourself.
Where it stops
AWS only, and experimental. About half the provider’s types carry no tags, so they are identifiable but not governable by a tag condition. The identity of a resource has to be knowable before it is created, and a read-only check reports what refuses before you commit to anything.
On the scorecard, choudoufu clears nine of fourteen. Terraform clears one.