@intentius/chant-lexicon-terraform 0.124.44 → 0.124.46

package/src/__fixtures__/kind-type/app/main.tf

@@ -0,0 +1,35 @@
+# Two instances, one IAM role and one inline policy on it. The policy's type
+# begins with the role's, so `kind:aws_iam_role` has to stop at the type
+# boundary to leave it out (chant #4366).
+
+resource "aws_iam_role" "app" {
+  name               = "app"
+  assume_role_policy = "{}"
+}
+
+resource "aws_iam_role_policy" "app" {
+  name   = "app"
+  role   = aws_iam_role.app.id
+  policy = "{}"
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-12345678"
+  instance_type = "t3.micro"
+}
+
+resource "aws_instance" "worker" {
+  ami           = "ami-12345678"
+  instance_type = "t3.micro"
+}
+
+# A data source reads an AMI, it does not manage one: its type is
+# `data.aws_ami`, never `aws_ami`.
+data "aws_ami" "base" {
+  most_recent = true
+  owners      = ["amazon"]
+}
+
+variable "region" {
+  default = "us-east-1"
+}

package/src/__fixtures__/kind-type/chant.config.ts

@@ -0,0 +1,11 @@
+import type { ChantConfig } from "@intentius/chant/config";
+import "@intentius/chant-lexicon-terraform";
+
+export default {
+  lexicons: ["terraform"],
+  terraform: {
+    roots: {
+      app: { dir: "./app" },
+    },
+  },
+} satisfies ChantConfig;

package/src/__fixtures__/kind-type/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "chant-fixture-terraform-kind-type",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module"
+}

package/src/__fixtures__/live-plan-depth/README.md

@@ -0,0 +1,59 @@
+# The plan depth on a live root: three documents recorded from `live-estate/`
+
+`describe-resources.live-plan.test.ts` (#4371) reads these. All three were
+recorded on 2026-10-23 by the published choudoufu **v0.30.0** release binary
+(`gh release download v0.30.0 -R INTENTIUS/choudoufu -p
+'choudoufu_v0.30.0_darwin_arm64.tar.gz' -p SHA256SUMS`, verified against
+`SHA256SUMS`; `choudoufu version` prints `choudoufu v0.30.0 (based on OpenTofu
+v1.13.0)`), against choudoufu's pinned floci emulator
+(`ghcr.io/lex00/floci@sha256:5ec92ae8046445d62c0009590dd09f04560886e5a5ef31248cb3fcc09b2961ec`,
+that repository's `live/floci-image` at the time).
+
+The configuration is `../live-estate/` as checked in, estate
+`stateless-e2e-block`:
+
+```
+# unowned.tf, rule.tf and adoptable.tf held back over the apply, as live-estate/README.md does
+choudoufu init -input=false
+choudoufu apply -auto-approve -input=false
+# restore the three, then:
+aws logs create-log-group --log-group-name /stateless-e2e-block/adoptable
+aws logs create-log-group --log-group-name /stateless-e2e-block/held-elsewhere
+aws logs tag-log-group    --log-group-name /stateless-e2e-block/held-elsewhere \
+  --tags tofu-estate=other-estate,tofu-address=aws_cloudwatch_log_group.elsewhere
+# out-of-band drift on two bound resources
+aws logs put-retention-policy --log-group-name /stateless-e2e-block/app --retention-in-days 3
+aws ec2 create-tags --resources <aws_vpc.main's id> --tags Key=drifted,Value=yes
+
+choudoufu plan -input=false -lock=false -out=<tmp>/plan.tfplan
+choudoufu show -json <tmp>/plan.tfplan            > show-plan.json
+choudoufu live-plan -detailed-exitcode -json      > live-plan.json
+```
+
+`-lock=false` is accepted, the plan exits 0, and the root was byte-for-byte
+unchanged after the plan and the show (every entry's size and mtime compared,
+`.terraform/choudoufu-cache.tfstate` and `.tofu-records/` included).
+
+`show-plan-sensitive.json` is the same root one step further, recorded to see
+what a live root does with a value from a `sensitive` variable. In a copy of
+the root, `secret.tf` declared `variable "token" { sensitive = true, default =
+"hunter2" }` and `aws_vpc.main` got `tags = { token = var.token }`; that was
+applied, the default changed to `"hunter3"`, and the plan and show above were
+run again.
+
+## What the documents show
+
+choudoufu rebuilds prior state from the account on every run, so:
+
+- `resource_drift` is empty although two resources drifted. The drift is in
+  `resource_changes` as a planned `update`, with the live value in `before`
+  (`retention_in_days: 3`, `tags.drifted: "yes"`) and the declared value in
+  `after`.
+- `prior_state` holds exactly the six instances `live-plan`'s `bound[]` names.
+- The unowned log groups and the never-applied ones are planned `create`s
+  with no row in `prior_state`.
+- In `show-plan-sensitive.json`, `after_sensitive` flags `tags.token` and
+  `before_sensitive` flags nothing: the live value in `before` is the previous
+  secret, `"hunter2"`, unflagged. A stock root's state records which paths were
+  sensitive, so its `before` is flagged; a live root's is not. This is why
+  `plan-observation.ts` redacts both sides of a path flagged on either.

package/src/__fixtures__/live-plan-depth/live-plan.json

@@ -0,0 +1,110 @@
+{
+  "estate": "stateless-e2e-block",
+  "choudoufu_version": "v0.30.0",
+  "upstream_version": "1.13.0",
+  "bound": [
+    {
+      "addr": "aws_cloudwatch_log_group.app",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/stateless-e2e-block/app",
+      "identity_values": {
+        "name": "/stateless-e2e-block/app"
+      },
+      "source": "derived"
+    },
+    {
+      "addr": "aws_eip.pool[0]",
+      "type": "aws_eip",
+      "identity": "eipalloc-e1062da9f7342113c",
+      "source": "marker"
+    },
+    {
+      "addr": "aws_eip.pool[1]",
+      "type": "aws_eip",
+      "identity": "eipalloc-2f7384c236840e111",
+      "source": "marker"
+    },
+    {
+      "addr": "aws_security_group.main",
+      "type": "aws_security_group",
+      "identity": "sg-0c062a67f870be73b",
+      "source": "marker"
+    },
+    {
+      "addr": "aws_subnet.app",
+      "type": "aws_subnet",
+      "identity": "subnet-02db9d6c",
+      "source": "marker"
+    },
+    {
+      "addr": "aws_vpc.main",
+      "type": "aws_vpc",
+      "identity": "vpc-a563d5eb",
+      "source": "marker"
+    }
+  ],
+  "omissions": [
+    {
+      "addr": "aws_cloudwatch_log_group.adoptable",
+      "reason": "UNOWNED",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/stateless-e2e-block/adoptable\" and carries no tofu-estate marker, so this estate does not own it and the plan proposes creating the resource this configuration declares - which, for a type whose name must be unique, the cloud will refuse while the unowned one holds it. Adopt it by writing tofu-estate=\"stateless-e2e-block\" and tofu-address=\"aws_cloudwatch_log_group.adoptable\" onto it, then re-run; or set policy { declared_untagged = \"adopt\" } in the live block to have this run adopt it for you; or point this resource at a name nobody is using."
+    },
+    {
+      "addr": "aws_cloudwatch_log_group.held_elsewhere",
+      "reason": "UNOWNED",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/stateless-e2e-block/held-elsewhere\" and carries tofu-estate=\"other-estate\", so it belongs to another estate and nothing in this plan reads, changes or destroys it. Taking it over is something you do deliberately: `live-mv -from-estate=other-estate` rewrites the marker to this estate one address at a time, and `live-import -approve` stamps this estate's markers over the resources a state file lists. Or point this resource at a name nobody is using. See live/MARKERS.md, \"Ownership semantics\"."
+    },
+    {
+      "addr": "aws_cloudwatch_log_group.never_applied",
+      "reason": "ABSENT",
+      "detail": "The provider reports no aws_cloudwatch_log_group exists with identity \"/stateless-e2e-block/never-applied\", so this resource has not been created yet. The plan will propose creating it."
+    },
+    {
+      "addr": "aws_security_group_rule.https",
+      "reason": "ABSENT",
+      "detail": "The provider reports no aws_security_group_rule exists with identity \"sg-0c062a67f870be73b_ingress_tcp_443_443_10.99.0.0/16\", so this resource has not been created yet. The plan will propose creating it."
+    },
+    {
+      "addr": "aws_vpc.adoptable",
+      "reason": "NEEDS_DISCOVERY",
+      "detail": "No import identity exists for this instance: EC2 assigns the VPC ID (vpc-…) at create time; no configuration argument determines it. Marker discovery will find it; until then the plan will propose creating it."
+    }
+  ],
+  "unowned": [
+    {
+      "addr": "aws_cloudwatch_log_group.adoptable",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/stateless-e2e-block/adoptable",
+      "adopt_tofu_estate": "stateless-e2e-block",
+      "adopt_tofu_address": "aws_cloudwatch_log_group.adoptable"
+    },
+    {
+      "addr": "aws_cloudwatch_log_group.held_elsewhere",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/stateless-e2e-block/held-elsewhere",
+      "tofu_estate": "other-estate"
+    }
+  ],
+  "foreign": null,
+  "adoptable": [],
+  "swept": [
+    "aws_vpc"
+  ],
+  "diagnostics": [
+    {
+      "severity": "warning",
+      "summary": "Provider version does not match the admission evidence version",
+      "detail": "This run resolved hashicorp/aws 6.58.0. Live resource markers' admission table - which resource types are accepted, what their import IDs look like, and how their identity is resolved - was verified against hashicorp/aws 6.59.0 (live/survey.json). Import grammar and identity schemas are the parts of that table a provider version change can invalidate: an import ID format or an identity attribute that changed between 6.58.0 and 6.59.0 would misbehave here with no further warning. Taggability judgments are not version-sensitive in the same way and rarely change between provider releases. This is a caution, not a failure: the plan continues."
+    },
+    {
+      "severity": "warning",
+      "summary": "Live resource outside this estate",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/stateless-e2e-block/adoptable\" and carries no tofu-estate marker, so this estate does not own it and the plan proposes creating the resource this configuration declares - which, for a type whose name must be unique, the cloud will refuse while the unowned one holds it. Adopt it by writing tofu-estate=\"stateless-e2e-block\" and tofu-address=\"aws_cloudwatch_log_group.adoptable\" onto it, then re-run; or set policy { declared_untagged = \"adopt\" } in the live block to have this run adopt it for you; or point this resource at a name nobody is using."
+    },
+    {
+      "severity": "warning",
+      "summary": "Live resource outside this estate",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/stateless-e2e-block/held-elsewhere\" and carries tofu-estate=\"other-estate\", so it belongs to another estate and nothing in this plan reads, changes or destroys it. Taking it over is something you do deliberately: `live-mv -from-estate=other-estate` rewrites the marker to this estate one address at a time, and `live-import -approve` stamps this estate's markers over the resources a state file lists. Or point this resource at a name nobody is using. See live/MARKERS.md, \"Ownership semantics\"."
+    }
+  ]
+}

package/src/__fixtures__/live-plan-depth/show-plan-sensitive.json

@@ -0,0 +1 @@
+{"format_version":"1.2","terraform_version":"1.13.0","variables":{"token":{"value":"hunter3"}},"planned_values":{"root_module":{"resources":[{"address":"aws_cloudwatch_log_group.adoptable","mode":"managed","type":"aws_cloudwatch_log_group","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"kms_key_id":null,"name":"/stateless-e2e-block/adoptable","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"name":null,"region":null},"identity_schema_version":0},{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_cloudwatch_log_group.held_elsewhere","mode":"managed","type":"aws_cloudwatch_log_group","name":"held_elsewhere","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"kms_key_id":null,"name":"/stateless-e2e-block/held-elsewhere","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"name":null,"region":null},"identity_schema_version":0},{"address":"aws_cloudwatch_log_group.never_applied","mode":"managed","type":"aws_cloudwatch_log_group","name":"never_applied","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"kms_key_id":null,"name":"/stateless-e2e-block/never-applied","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"name":null,"region":null},"identity_schema_version":0},{"address":"aws_eip.pool[0]","mode":"managed","type":"aws_eip","name":"pool","index":0,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_eip.pool[1]","mode":"managed","type":"aws_eip","name":"pool","index":1,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_security_group_rule.https","mode":"managed","type":"aws_security_group_rule","name":"https","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":2,"values":{"cidr_blocks":["10.99.0.0/16"],"description":null,"from_port":443,"ipv6_cidr_blocks":null,"prefix_list_ids":null,"protocol":"tcp","region":"us-east-1","security_group_id":"sg-0c062a67f870be73b","self":false,"timeouts":null,"to_port":443,"type":"ingress"},"sensitive_values":{"cidr_blocks":[false]}},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_vpc.adoptable","mode":"managed","type":"aws_vpc","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"assign_generated_ipv6_cidr_block":null,"cidr_block":"10.88.0.0/16","enable_dns_support":true,"instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_ipam_pool_id":null,"ipv6_netmask_length":null,"region":"us-east-1","tags":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"id":null,"region":null},"identity_schema_version":0},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter3"},"tags_all":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter3"}},"sensitive_values":{"tags":{"token":true},"tags_all":{}},"identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"},"identity_schema_version":0}]}},"resource_changes":[{"address":"aws_cloudwatch_log_group.adoptable","mode":"managed","type":"aws_cloudwatch_log_group","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"kms_key_id":null,"name":"/stateless-e2e-block/adoptable","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"deletion_protection_enabled":true,"id":true,"log_group_class":true,"name_prefix":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"name":null,"region":null}}},{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"after":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"},"after_identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"}}},{"address":"aws_cloudwatch_log_group.held_elsewhere","mode":"managed","type":"aws_cloudwatch_log_group","name":"held_elsewhere","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"kms_key_id":null,"name":"/stateless-e2e-block/held-elsewhere","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"deletion_protection_enabled":true,"id":true,"log_group_class":true,"name_prefix":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"name":null,"region":null}}},{"address":"aws_cloudwatch_log_group.never_applied","mode":"managed","type":"aws_cloudwatch_log_group","name":"never_applied","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"kms_key_id":null,"name":"/stateless-e2e-block/never-applied","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"deletion_protection_enabled":true,"id":true,"log_group_class":true,"name_prefix":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"name":null,"region":null}}},{"address":"aws_eip.pool[0]","mode":"managed","type":"aws_eip","name":"pool","index":0,"provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"after":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"}}},{"address":"aws_eip.pool[1]","mode":"managed","type":"aws_eip","name":"pool","index":1,"provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"after":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"}}},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after_unknown":{},"before_sensitive":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"after_sensitive":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"}}},{"address":"aws_security_group_rule.https","mode":"managed","type":"aws_security_group_rule","name":"https","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"cidr_blocks":["10.99.0.0/16"],"description":null,"from_port":443,"ipv6_cidr_blocks":null,"prefix_list_ids":null,"protocol":"tcp","region":"us-east-1","security_group_id":"sg-0c062a67f870be73b","self":false,"timeouts":null,"to_port":443,"type":"ingress"},"after_unknown":{"cidr_blocks":[false],"id":true,"security_group_rule_id":true,"source_security_group_id":true},"before_sensitive":false,"after_sensitive":{"cidr_blocks":[false]}}},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"}}},{"address":"aws_vpc.adoptable","mode":"managed","type":"aws_vpc","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"assign_generated_ipv6_cidr_block":null,"cidr_block":"10.88.0.0/16","enable_dns_support":true,"instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_ipam_pool_id":null,"ipv6_netmask_length":null,"region":"us-east-1","tags":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"default_network_acl_id":true,"default_route_table_id":true,"default_security_group_id":true,"dhcp_options_id":true,"enable_dns_hostnames":true,"enable_network_address_usage_metrics":true,"id":true,"ipv6_association_id":true,"ipv6_cidr_block":true,"ipv6_cidr_block_network_border_group":true,"main_route_table_id":true,"owner_id":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"id":null,"region":null}}},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["update"],"before":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter2"},"tags_all":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter2"}},"after":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter3"},"tags_all":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter3"}},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{"token":true},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"}}}],"prior_state":{"format_version":"1.0","terraform_version":"1.13.0","values":{"root_module":{"resources":[{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_eip.pool[0]","mode":"managed","type":"aws_eip","name":"pool","index":0,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_eip.pool[1]","mode":"managed","type":"aws_eip","name":"pool","index":1,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"depends_on":["aws_vpc.main"],"identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"tags":{},"tags_all":{}},"depends_on":["aws_vpc.main"],"identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter2"},"tags_all":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block","token":"hunter2"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"},"identity_schema_version":0}]}}},"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.opentofu.org/hashicorp/aws","version_constraint":"6.58.0","expressions":{"s3_use_path_style":{"constant_value":true},"skip_credentials_validation":{"constant_value":true},"skip_metadata_api_check":{"constant_value":true}}}},"root_module":{"resources":[{"address":"aws_cloudwatch_log_group.adoptable","mode":"managed","type":"aws_cloudwatch_log_group","name":"adoptable","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/adoptable"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/app"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_cloudwatch_log_group.held_elsewhere","mode":"managed","type":"aws_cloudwatch_log_group","name":"held_elsewhere","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/held-elsewhere"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_cloudwatch_log_group.never_applied","mode":"managed","type":"aws_cloudwatch_log_group","name":"never_applied","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/never-applied"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_eip.pool","mode":"managed","type":"aws_eip","name":"pool","provider_config_key":"aws","expressions":{"domain":{"constant_value":"vpc"}},"schema_version":0,"count_expression":{"constant_value":2}},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_config_key":"aws","expressions":{"description":{"constant_value":"estate-block fixture security group"},"name":{"constant_value":"stateless-e2e-block-main"},"vpc_id":{"references":["aws_vpc.main.id","aws_vpc.main"]}},"schema_version":1},{"address":"aws_security_group_rule.https","mode":"managed","type":"aws_security_group_rule","name":"https","provider_config_key":"aws","expressions":{"cidr_blocks":{"constant_value":["10.99.0.0/16"]},"from_port":{"constant_value":443},"protocol":{"constant_value":"tcp"},"security_group_id":{"references":["aws_security_group.main.id","aws_security_group.main"]},"to_port":{"constant_value":443},"type":{"constant_value":"ingress"}},"schema_version":2},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_config_key":"aws","expressions":{"cidr_block":{"constant_value":"10.99.1.0/24"},"vpc_id":{"references":["aws_vpc.main.id","aws_vpc.main"]}},"schema_version":1},{"address":"aws_vpc.adoptable","mode":"managed","type":"aws_vpc","name":"adoptable","provider_config_key":"aws","expressions":{"cidr_block":{"constant_value":"10.88.0.0/16"}},"schema_version":1},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_config_key":"aws","expressions":{"cidr_block":{"constant_value":"10.99.0.0/16"},"tags":{"references":["var.token"]}},"schema_version":1}],"variables":{"token":{"type":"string","default":"hunter3","sensitive":true}}}},"relevant_attributes":[{"resource":"aws_security_group.main","attribute":["id"]}],"timestamp":"2026-10-23T19:07:24Z","errored":false}

package/src/__fixtures__/live-plan-depth/show-plan.json

@@ -0,0 +1 @@
+{"format_version":"1.2","terraform_version":"1.13.0","planned_values":{"root_module":{"resources":[{"address":"aws_cloudwatch_log_group.adoptable","mode":"managed","type":"aws_cloudwatch_log_group","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"kms_key_id":null,"name":"/stateless-e2e-block/adoptable","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"name":null,"region":null},"identity_schema_version":0},{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_cloudwatch_log_group.held_elsewhere","mode":"managed","type":"aws_cloudwatch_log_group","name":"held_elsewhere","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"kms_key_id":null,"name":"/stateless-e2e-block/held-elsewhere","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"name":null,"region":null},"identity_schema_version":0},{"address":"aws_cloudwatch_log_group.never_applied","mode":"managed","type":"aws_cloudwatch_log_group","name":"never_applied","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"kms_key_id":null,"name":"/stateless-e2e-block/never-applied","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"name":null,"region":null},"identity_schema_version":0},{"address":"aws_eip.pool[0]","mode":"managed","type":"aws_eip","name":"pool","index":0,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_eip.pool[1]","mode":"managed","type":"aws_eip","name":"pool","index":1,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_security_group_rule.https","mode":"managed","type":"aws_security_group_rule","name":"https","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":2,"values":{"cidr_blocks":["10.99.0.0/16"],"description":null,"from_port":443,"ipv6_cidr_blocks":null,"prefix_list_ids":null,"protocol":"tcp","region":"us-east-1","security_group_id":"sg-0c062a67f870be73b","self":false,"timeouts":null,"to_port":443,"type":"ingress"},"sensitive_values":{"cidr_blocks":[false]}},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_vpc.adoptable","mode":"managed","type":"aws_vpc","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"assign_generated_ipv6_cidr_block":null,"cidr_block":"10.88.0.0/16","enable_dns_support":true,"instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_ipam_pool_id":null,"ipv6_netmask_length":null,"region":"us-east-1","tags":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":null,"id":null,"region":null},"identity_schema_version":0},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"},"identity_schema_version":0}]}},"resource_changes":[{"address":"aws_cloudwatch_log_group.adoptable","mode":"managed","type":"aws_cloudwatch_log_group","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"kms_key_id":null,"name":"/stateless-e2e-block/adoptable","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.adoptable","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"deletion_protection_enabled":true,"id":true,"log_group_class":true,"name_prefix":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"name":null,"region":null}}},{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["update"],"before":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":3,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"after":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"},"after_identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"}}},{"address":"aws_cloudwatch_log_group.held_elsewhere","mode":"managed","type":"aws_cloudwatch_log_group","name":"held_elsewhere","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"kms_key_id":null,"name":"/stateless-e2e-block/held-elsewhere","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.held_elsewhere","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"deletion_protection_enabled":true,"id":true,"log_group_class":true,"name_prefix":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"name":null,"region":null}}},{"address":"aws_cloudwatch_log_group.never_applied","mode":"managed","type":"aws_cloudwatch_log_group","name":"never_applied","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"kms_key_id":null,"name":"/stateless-e2e-block/never-applied","region":"us-east-1","retention_in_days":1,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.never_applied","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"deletion_protection_enabled":true,"id":true,"log_group_class":true,"name_prefix":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"name":null,"region":null}}},{"address":"aws_eip.pool[0]","mode":"managed","type":"aws_eip","name":"pool","index":0,"provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"after":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"}}},{"address":"aws_eip.pool[1]","mode":"managed","type":"aws_eip","name":"pool","index":1,"provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"after":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"}}},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after_unknown":{},"before_sensitive":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"after_sensitive":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"}}},{"address":"aws_security_group_rule.https","mode":"managed","type":"aws_security_group_rule","name":"https","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"cidr_blocks":["10.99.0.0/16"],"description":null,"from_port":443,"ipv6_cidr_blocks":null,"prefix_list_ids":null,"protocol":"tcp","region":"us-east-1","security_group_id":"sg-0c062a67f870be73b","self":false,"timeouts":null,"to_port":443,"type":"ingress"},"after_unknown":{"cidr_blocks":[false],"id":true,"security_group_rule_id":true,"source_security_group_id":true},"before_sensitive":false,"after_sensitive":{"cidr_blocks":[false]}}},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["no-op"],"before":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"}}},{"address":"aws_vpc.adoptable","mode":"managed","type":"aws_vpc","name":"adoptable","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"assign_generated_ipv6_cidr_block":null,"cidr_block":"10.88.0.0/16","enable_dns_support":true,"instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_ipam_pool_id":null,"ipv6_netmask_length":null,"region":"us-east-1","tags":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_vpc.adoptable","tofu-estate":"stateless-e2e-block"}},"after_unknown":{"arn":true,"default_network_acl_id":true,"default_route_table_id":true,"default_security_group_id":true,"dhcp_options_id":true,"enable_dns_hostnames":true,"enable_network_address_usage_metrics":true,"id":true,"ipv6_association_id":true,"ipv6_cidr_block":true,"ipv6_cidr_block_network_border_group":true,"main_route_table_id":true,"owner_id":true,"tags":{},"tags_all":{}},"before_sensitive":false,"after_sensitive":{"tags":{},"tags_all":{}},"after_identity":{"account_id":null,"id":null,"region":null}}},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","change":{"actions":["update"],"before":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"drifted":"yes","tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"drifted":"yes","tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"}},"after":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"}},"after_unknown":{},"before_sensitive":{"tags":{},"tags_all":{}},"after_sensitive":{"tags":{},"tags_all":{}},"before_identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"},"after_identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"}}}],"prior_state":{"format_version":"1.0","terraform_version":"1.13.0","values":{"root_module":{"resources":[{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"arn":"arn:aws:logs:us-east-1:000000000000:log-group:/stateless-e2e-block/app","deletion_protection_enabled":false,"id":"/stateless-e2e-block/app","kms_key_id":"","log_group_class":"","name":"/stateless-e2e-block/app","name_prefix":"","region":"us-east-1","retention_in_days":3,"skip_destroy":false,"tags":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_cloudwatch_log_group.app","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","name":"/stateless-e2e-block/app","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_eip.pool[0]","mode":"managed","type":"aws_eip","name":"pool","index":0,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-e1062da9f7342113c","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-e1062da9f7342113c","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-e1062da9f7342113c","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-217-250-135.compute-1.amazonaws.com","public_ip":"54.217.250.135","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"tags_all":{"tofu-address":"aws_eip.pool:0","tofu-estate":"stateless-e2e-block","tofu-slot":"0"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-e1062da9f7342113c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_eip.pool[1]","mode":"managed","type":"aws_eip","name":"pool","index":1,"provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":0,"values":{"address":null,"allocation_id":"eipalloc-2f7384c236840e111","arn":"arn:aws:ec2:us-east-1:000000000000:elastic-ip/eipalloc-2f7384c236840e111","associate_with_private_ip":null,"association_id":"","carrier_ip":"","customer_owned_ip":"","customer_owned_ipv4_pool":"","domain":"vpc","id":"eipalloc-2f7384c236840e111","instance":"","ipam_pool_id":"","network_border_group":"","network_interface":"","private_dns":"","private_ip":"","ptr_record":"","public_dns":"ec2-54-3-211-58.compute-1.amazonaws.com","public_ip":"54.3.211.58","public_ipv4_pool":"","region":"us-east-1","tags":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"tags_all":{"tofu-address":"aws_eip.pool:1","tofu-estate":"stateless-e2e-block","tofu-slot":"1"},"timeouts":null},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"eipalloc-2f7384c236840e111","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:security-group/sg-0c062a67f870be73b","description":"estate-block fixture security group","egress":[],"id":"sg-0c062a67f870be73b","ingress":[],"name":"stateless-e2e-block-main","name_prefix":"","owner_id":"000000000000","region":"us-east-1","revoke_rules_on_delete":false,"tags":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_security_group.main","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"egress":[],"ingress":[],"tags":{},"tags_all":{}},"depends_on":["aws_vpc.main"],"identity":{"account_id":"000000000000","id":"sg-0c062a67f870be73b","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:subnet/subnet-02db9d6c","assign_ipv6_address_on_creation":false,"availability_zone":"us-east-1a","availability_zone_id":"us-east-1-az1","cidr_block":"10.99.1.0/24","customer_owned_ipv4_pool":"","enable_dns64":false,"enable_lni_at_device_index":0,"enable_resource_name_dns_a_record_on_launch":false,"enable_resource_name_dns_aaaa_record_on_launch":false,"id":"subnet-02db9d6c","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_cidr_block":"","ipv6_cidr_block_association_id":"","ipv6_ipam_pool_id":null,"ipv6_native":false,"ipv6_netmask_length":null,"map_customer_owned_ip_on_launch":false,"map_public_ip_on_launch":false,"outpost_arn":"","owner_id":"000000000000","private_dns_hostname_type_on_launch":"","region":"us-east-1","tags":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"tags_all":{"tofu-address":"aws_subnet.app","tofu-estate":"stateless-e2e-block"},"timeouts":null,"vpc_id":"vpc-a563d5eb"},"sensitive_values":{"tags":{},"tags_all":{}},"depends_on":["aws_vpc.main"],"identity":{"account_id":"000000000000","id":"subnet-02db9d6c","region":"us-east-1"},"identity_schema_version":0},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_name":"registry.opentofu.org/hashicorp/aws","schema_version":1,"values":{"arn":"arn:aws:ec2:us-east-1:000000000000:vpc/vpc-a563d5eb","assign_generated_ipv6_cidr_block":false,"cidr_block":"10.99.0.0/16","default_network_acl_id":"acl-0a63fd7378cbbedb0","default_route_table_id":"rtb-fa4800a1ebe2f4b14","default_security_group_id":"sg-c39593c9711362fa1","dhcp_options_id":"dopt-default","enable_dns_hostnames":false,"enable_dns_support":true,"enable_network_address_usage_metrics":false,"id":"vpc-a563d5eb","instance_tenancy":"default","ipv4_ipam_pool_id":null,"ipv4_netmask_length":null,"ipv6_association_id":"","ipv6_cidr_block":"","ipv6_cidr_block_network_border_group":"","ipv6_ipam_pool_id":"","ipv6_netmask_length":0,"main_route_table_id":"rtb-fa4800a1ebe2f4b14","owner_id":"000000000000","region":"us-east-1","tags":{"drifted":"yes","tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"},"tags_all":{"drifted":"yes","tofu-address":"aws_vpc.main","tofu-estate":"stateless-e2e-block"}},"sensitive_values":{"tags":{},"tags_all":{}},"identity":{"account_id":"000000000000","id":"vpc-a563d5eb","region":"us-east-1"},"identity_schema_version":0}]}}},"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.opentofu.org/hashicorp/aws","version_constraint":"6.58.0","expressions":{"s3_use_path_style":{"constant_value":true},"skip_credentials_validation":{"constant_value":true},"skip_metadata_api_check":{"constant_value":true}}}},"root_module":{"resources":[{"address":"aws_cloudwatch_log_group.adoptable","mode":"managed","type":"aws_cloudwatch_log_group","name":"adoptable","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/adoptable"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_cloudwatch_log_group.app","mode":"managed","type":"aws_cloudwatch_log_group","name":"app","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/app"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_cloudwatch_log_group.held_elsewhere","mode":"managed","type":"aws_cloudwatch_log_group","name":"held_elsewhere","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/held-elsewhere"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_cloudwatch_log_group.never_applied","mode":"managed","type":"aws_cloudwatch_log_group","name":"never_applied","provider_config_key":"aws","expressions":{"name":{"constant_value":"/stateless-e2e-block/never-applied"},"retention_in_days":{"constant_value":1}},"schema_version":0},{"address":"aws_eip.pool","mode":"managed","type":"aws_eip","name":"pool","provider_config_key":"aws","expressions":{"domain":{"constant_value":"vpc"}},"schema_version":0,"count_expression":{"constant_value":2}},{"address":"aws_security_group.main","mode":"managed","type":"aws_security_group","name":"main","provider_config_key":"aws","expressions":{"description":{"constant_value":"estate-block fixture security group"},"name":{"constant_value":"stateless-e2e-block-main"},"vpc_id":{"references":["aws_vpc.main.id","aws_vpc.main"]}},"schema_version":1},{"address":"aws_security_group_rule.https","mode":"managed","type":"aws_security_group_rule","name":"https","provider_config_key":"aws","expressions":{"cidr_blocks":{"constant_value":["10.99.0.0/16"]},"from_port":{"constant_value":443},"protocol":{"constant_value":"tcp"},"security_group_id":{"references":["aws_security_group.main.id","aws_security_group.main"]},"to_port":{"constant_value":443},"type":{"constant_value":"ingress"}},"schema_version":2},{"address":"aws_subnet.app","mode":"managed","type":"aws_subnet","name":"app","provider_config_key":"aws","expressions":{"cidr_block":{"constant_value":"10.99.1.0/24"},"vpc_id":{"references":["aws_vpc.main.id","aws_vpc.main"]}},"schema_version":1},{"address":"aws_vpc.adoptable","mode":"managed","type":"aws_vpc","name":"adoptable","provider_config_key":"aws","expressions":{"cidr_block":{"constant_value":"10.88.0.0/16"}},"schema_version":1},{"address":"aws_vpc.main","mode":"managed","type":"aws_vpc","name":"main","provider_config_key":"aws","expressions":{"cidr_block":{"constant_value":"10.99.0.0/16"}},"schema_version":1}]}},"relevant_attributes":[{"resource":"aws_security_group.main","attribute":["id"]}],"timestamp":"2026-10-23T19:05:52Z","errored":false}

package/src/__fixtures__/plan-read/main.tf

@@ -0,0 +1,46 @@
+# The plan depth's real-binary fixture (#4358). Built-in `terraform_data`
+# only, so `init` needs no registry and no network, and a `local` backend, so
+# no credentials. `plan-read.acceptance.test.ts` copies it to a temp dir,
+# applies it at generation 1, then reads a plan at generation 2
+# (`next.tfvars`), which replaces one block, updates two, and leaves one
+# value unknown until apply.
+terraform {
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+}
+
+variable "generation" {
+  type    = string
+  default = "1"
+}
+
+# A sensitive default, on purpose: the redaction tests need a known secret
+# to look for. TF006 is right about it in a real root.
+# chant-ignore-block: TF006
+variable "token" {
+  type      = string
+  default   = "hunter2"
+  sensitive = true
+}
+
+# Replaced: `triggers_replace` forces it, so the plan carries
+# `replace_paths = [["triggers_replace"]]` and an `action_reason`.
+resource "terraform_data" "replaced" {
+  triggers_replace = var.generation
+  input            = "stable"
+}
+
+# Updated in place, with a sensitive value nested in a map.
+resource "terraform_data" "updated" {
+  input = {
+    name  = "app-${var.generation}"
+    token = var.token
+  }
+}
+
+# Updated, and its input is unknown until apply: it reads the replaced
+# block's new id.
+resource "terraform_data" "downstream" {
+  input = terraform_data.replaced.id
+}

package/src/__fixtures__/plan-read/next.tfvars

@@ -0,0 +1 @@
+generation = "2"

package/src/__fixtures__/plan-read-drift/README.md

@@ -0,0 +1,33 @@
+# Recording `../show-plan.json`
+
+`../show-plan.json` is `terraform show -json` over a saved plan of this root,
+recorded on 2026-10-23 with Terraform v1.15.8 on darwin_arm64 and
+`scottwinkler/shell` v1.7.10 from the public registry. The plan depth's unit
+tests (`../../describe-resources.plan.test.ts`) read it, so they run no binary.
+
+The recording, from a temp copy of this directory:
+
+```
+terraform init -input=false
+terraform apply -auto-approve -input=false        # generation 1
+printf '{"port":"9090"}' > conf.json               # the change outside Terraform
+terraform plan -input=false -lock=false -var-file=next.tfvars -out=$TMP/plan.tfplan
+terraform show -json $TMP/plan.tfplan | jq . > ../show-plan.json
+```
+
+What the document holds, and what each block is for:
+
+| block | plan | why it is here |
+| --- | --- | --- |
+| `shell_script.conf` | drift `update` (`dirty`, `read_error`), then replace forced by `dirty` | `resource_drift`, `replace_paths`, `action_reason` |
+| `terraform_data.reader` | update, `input` unknown until apply | `relevant_attributes` names `shell_script.conf` `output.port` |
+| `terraform_data.replaced` | replace forced by `triggers_replace` | `replace_paths`, `action_reason` |
+| `terraform_data.updated` | update of a map holding a sensitive `token` | `before_sensitive`/`after_sensitive` nested in a map |
+| `terraform_data.downstream` | update, `input` unknown until apply | `after_unknown` |
+
+The token's value is `hunter2`. Terraform flags it under `input.token` and
+leaves the copy in `output.token` unflagged, which is why the reader also
+redacts any value equal to a flagged one.
+
+The shell provider runs its commands in `path.module`, so no absolute path of
+the recording machine is in the document.