second first commit

compatibility-tests/compat-terraform/test/apigateway-rest-readback-tf/main.tf

@@ -0,0 +1,104 @@
+# Verifies that a REST API gateway converges: a second plan reports no changes.
+#
+# GetMethod dropped requestParameters, GetRestApi dropped policy, and GetStage dropped
+# accessLogSettings, tracingEnabled and tags. Terraform planned the same three in-place
+# updates on every run, and because the deployment's redeployment trigger hashes the
+# method, the re-apply failed with "Provider produced inconsistent final plan".
+
+variable "extra_request_parameter" {
+  type    = bool
+  default = false
+}
+
+variable "stage_env" {
+  type    = string
+  default = "local"
+}
+
+resource "aws_api_gateway_rest_api" "api" {
+  name = "floci-apigw-rest-readback"
+}
+
+resource "aws_api_gateway_resource" "proxy" {
+  rest_api_id = aws_api_gateway_rest_api.api.id
+  parent_id   = aws_api_gateway_rest_api.api.root_resource_id
+  path_part   = "{proxy+}"
+}
+
+resource "aws_api_gateway_method" "proxy" {
+  rest_api_id   = aws_api_gateway_rest_api.api.id
+  resource_id   = aws_api_gateway_resource.proxy.id
+  http_method   = "ANY"
+  authorization = "NONE"
+
+  request_parameters = merge(
+    { "method.request.path.proxy" = true },
+    var.extra_request_parameter ? { "method.request.header.X-Tenant" = false } : {},
+  )
+}
+
+resource "aws_api_gateway_integration" "proxy" {
+  rest_api_id = aws_api_gateway_rest_api.api.id
+  resource_id = aws_api_gateway_resource.proxy.id
+  http_method = aws_api_gateway_method.proxy.http_method
+  type        = "MOCK"
+
+  request_templates = {
+    "application/json" = "{\"statusCode\": 200}"
+  }
+}
+
+resource "aws_api_gateway_rest_api_policy" "api" {
+  rest_api_id = aws_api_gateway_rest_api.api.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = "*"
+      Action    = "execute-api:Invoke"
+      Resource  = "${aws_api_gateway_rest_api.api.execution_arn}/*"
+    }]
+  })
+}
+
+# The common module pattern from the bug report: the trigger hashes the method, so a
+# method that reads back differently than it was written breaks the apply itself.
+resource "aws_api_gateway_deployment" "api" {
+  rest_api_id = aws_api_gateway_rest_api.api.id
+
+  triggers = {
+    redeployment = sha1(jsonencode([
+      aws_api_gateway_resource.proxy,
+      aws_api_gateway_method.proxy,
+      aws_api_gateway_integration.proxy,
+    ]))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "local" {
+  rest_api_id          = aws_api_gateway_rest_api.api.id
+  deployment_id        = aws_api_gateway_deployment.api.id
+  stage_name           = "local"
+  xray_tracing_enabled = true
+
+  access_log_settings {
+    destination_arn = "arn:aws:logs:us-east-1:000000000000:log-group:floci-apigw-rest-readback"
+    format          = "$context.requestId $context.status"
+  }
+
+  tags = {
+    env = var.stage_env
+  }
+}
+
+output "rest_api_id" {
+  value = aws_api_gateway_rest_api.api.id
+}
+
+output "resource_id" {
+  value = aws_api_gateway_resource.proxy.id
+}

compatibility-tests/compat-terraform/test/apigateway-rest-readback-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    apigateway = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/apigateway_rest_readback.bats

@@ -0,0 +1,140 @@
+#!/usr/bin/env bats
+# API Gateway REST Read-Back Compatibility Test
+#
+# GetMethod dropped requestParameters, GetRestApi dropped policy, and GetStage dropped
+# accessLogSettings, tracingEnabled and tags. Every write succeeded, but the reads came back
+# without the values, so each plan proposed the same three in-place updates forever. With a
+# deployment trigger that hashes the method, the re-apply failed outright with "Provider
+# produced inconsistent final plan". This verifies the module applies, reads back what it
+# wrote, converges on a re-apply, and survives an in-place method change.
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    APIGW_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/apigateway-rest-readback-tf" && pwd)"
+    cd "$APIGW_TF_DIR"
+
+    echo "# === API Gateway REST Read-Back Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $APIGW_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    APIGW_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/apigateway-rest-readback-tf" && pwd)"
+    cd "$APIGW_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    APIGW_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/apigateway-rest-readback-tf" && pwd)"
+}
+
+@test "API Gateway read-back: GetMethod returns requestParameters" {
+    API_ID=$(terraform -chdir="$APIGW_TF_DIR" output -raw rest_api_id)
+    RESOURCE_ID=$(terraform -chdir="$APIGW_TF_DIR" output -raw resource_id)
+    run aws_cmd apigateway get-method --rest-api-id "$API_ID" --resource-id "$RESOURCE_ID" \
+        --http-method ANY --query 'requestParameters."method.request.path.proxy"' --output text
+    assert_success
+    assert_output "True"
+}
+
+@test "API Gateway read-back: GetRestApi returns the policy" {
+    API_ID=$(terraform -chdir="$APIGW_TF_DIR" output -raw rest_api_id)
+    run aws_cmd apigateway get-rest-api --rest-api-id "$API_ID" --query policy --output text
+    assert_success
+    assert_output --partial "execute-api:Invoke"
+}
+
+@test "API Gateway read-back: GetStage returns access logs, tracing and tags" {
+    API_ID=$(terraform -chdir="$APIGW_TF_DIR" output -raw rest_api_id)
+    run aws_cmd apigateway get-stage --rest-api-id "$API_ID" --stage-name local \
+        --query '[accessLogSettings.format, tracingEnabled, tags.env]' --output text
+    assert_success
+    assert_output "\$context.requestId \$context.status	True	local"
+}
+
+# The failure from the bug report: the method read back without requestParameters, so it
+# differed between plan and apply, the deployment trigger hash moved mid-apply, and the
+# re-apply died with "Provider produced inconsistent final plan".
+#
+# The re-apply may still replace the deployment once, whatever the server returns:
+# aws_api_gateway_method's create does not read the method back, so unset collections
+# (request_models, authorization_scopes) stay null in state until the first refresh fills
+# them in as empty, and that moves the trigger hash a single time. The stage then follows the
+# new deployment id, so only the method and the policy must stay untouched here.
+@test "API Gateway read-back: re-apply succeeds" {
+    cd "$APIGW_TF_DIR"
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    assert_success
+    refute_output --partial "inconsistent final plan"
+    refute_output --partial "aws_api_gateway_method.proxy: Modifying"
+    refute_output --partial "aws_api_gateway_rest_api_policy.api: Modifying"
+}
+
+# The critical assertion: before the fix every plan proposed the same three updates forever.
+@test "API Gateway read-back: plan after re-apply reports no changes" {
+    cd "$APIGW_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}
+
+# Changing a method request parameter goes through UpdateMethod patch operations and changes
+# the deployment trigger hash. This is where "inconsistent final plan" used to surface.
+@test "API Gateway read-back: changing a request parameter applies and re-plans clean" {
+    cd "$APIGW_TF_DIR"
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -var="extra_request_parameter=true" \
+        -input=false -auto-approve -no-color
+    assert_success
+    refute_output --partial "inconsistent final plan"
+
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -var="extra_request_parameter=true" \
+        -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}
+
+# Stage tag changes go through TagResource on the stage ARN, which used to tag the REST API
+# instead, so the stage never showed the new value and the plan never settled.
+@test "API Gateway read-back: changing a stage tag lands on the stage and re-plans clean" {
+    cd "$APIGW_TF_DIR"
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -var="extra_request_parameter=true" \
+        -var="stage_env=staging" -input=false -auto-approve -no-color
+    assert_success
+
+    API_ID=$(terraform -chdir="$APIGW_TF_DIR" output -raw rest_api_id)
+    run aws_cmd apigateway get-stage --rest-api-id "$API_ID" --stage-name local \
+        --query 'tags.env' --output text
+    assert_success
+    assert_output "staging"
+
+    run aws_cmd apigateway get-rest-api --rest-api-id "$API_ID" --query 'tags' --output text
+    assert_success
+    assert_output "None"
+
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -var="extra_request_parameter=true" \
+        -var="stage_env=staging" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}

compatibility-tests/compat-terraform/test/codeartifact-domain-repo-tf/main.tf

@@ -0,0 +1,84 @@
+# Verifies the CodeArtifact control plane: domain/repository CRUD, tags, upstream repositories,
+# and resource policies, all of which previously had no Floci support at all.
+
+resource "aws_codeartifact_domain" "test" {
+  domain = "floci-codeartifact-domain"
+
+  tags = {
+    owner = "platform"
+  }
+}
+
+data "aws_iam_policy_document" "domain_policy" {
+  statement {
+    effect    = "Allow"
+    actions   = ["codeartifact:GetDomainPermissions"]
+    resources = [aws_codeartifact_domain.test.arn]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+  }
+}
+
+resource "aws_codeartifact_domain_permissions_policy" "test" {
+  domain          = aws_codeartifact_domain.test.domain
+  policy_document = data.aws_iam_policy_document.domain_policy.json
+}
+
+resource "aws_codeartifact_repository" "store" {
+  domain     = aws_codeartifact_domain.test.domain
+  repository = "floci-codeartifact-store"
+}
+
+resource "aws_codeartifact_repository" "consumer" {
+  domain      = aws_codeartifact_domain.test.domain
+  repository  = "floci-codeartifact-consumer"
+  description = "consumes packages via the store repository"
+
+  upstream {
+    repository_name = aws_codeartifact_repository.store.repository
+  }
+
+  tags = {
+    team = "data"
+  }
+}
+
+data "aws_iam_policy_document" "repository_policy" {
+  statement {
+    effect    = "Allow"
+    actions   = ["codeartifact:ReadFromRepository"]
+    resources = [aws_codeartifact_repository.consumer.arn]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+  }
+}
+
+resource "aws_codeartifact_repository_permissions_policy" "test" {
+  domain          = aws_codeartifact_domain.test.domain
+  repository      = aws_codeartifact_repository.consumer.repository
+  policy_document = data.aws_iam_policy_document.repository_policy.json
+}
+
+output "domain_arn" {
+  value = aws_codeartifact_domain.test.arn
+}
+
+output "domain_owner_tag" {
+  value = aws_codeartifact_domain.test.tags["owner"]
+}
+
+output "repository_arn" {
+  value = aws_codeartifact_repository.consumer.arn
+}
+
+output "repository_upstream" {
+  value = aws_codeartifact_repository.consumer.upstream[0].repository_name
+}
+
+output "repository_team_tag" {
+  value = aws_codeartifact_repository.consumer.tags["team"]
+}

compatibility-tests/compat-terraform/test/codeartifact-domain-repo-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    codeartifact = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/codeartifact_domain_repo.bats

@@ -0,0 +1,88 @@
+#!/usr/bin/env bats
+# CodeArtifact Control Plane Compatibility Test
+#
+# Floci previously had no CodeArtifact support at all. This verifies aws_codeartifact_domain,
+# aws_codeartifact_domain_permissions_policy, aws_codeartifact_repository (with tags and an
+# upstream), and aws_codeartifact_repository_permissions_policy can all apply, that a second
+# plan is clean, and that destroy tears everything down in dependency order.
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    CA_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/codeartifact-domain-repo-tf" && pwd)"
+    cd "$CA_TF_DIR"
+
+    echo "# === CodeArtifact Domain/Repository Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $CA_TF_DIR" >&3
+
+    find .terraform -mindepth 1 -delete 2>/dev/null || true
+    rm -f .terraform.lock.hcl terraform.tfstate terraform.tfstate.backup 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    CA_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/codeartifact-domain-repo-tf" && pwd)"
+    cd "$CA_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    find .terraform -mindepth 1 -delete 2>/dev/null || true
+    rm -f .terraform.lock.hcl terraform.tfstate terraform.tfstate.backup 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    CA_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/codeartifact-domain-repo-tf" && pwd)"
+}
+
+@test "CodeArtifact domain/repository: apply reports the domain and repository ARNs" {
+    DOMAIN_ARN=$(terraform -chdir="$CA_TF_DIR" output -raw domain_arn)
+    REPO_ARN=$(terraform -chdir="$CA_TF_DIR" output -raw repository_arn)
+    assert_equal "$DOMAIN_ARN" "arn:aws:codeartifact:us-east-1:000000000000:domain/floci-codeartifact-domain"
+    assert_equal "$REPO_ARN" "arn:aws:codeartifact:us-east-1:000000000000:repository/floci-codeartifact-domain/floci-codeartifact-consumer"
+}
+
+@test "CodeArtifact domain/repository: tags and upstream round-trip" {
+    OWNER_TAG=$(terraform -chdir="$CA_TF_DIR" output -raw domain_owner_tag)
+    TEAM_TAG=$(terraform -chdir="$CA_TF_DIR" output -raw repository_team_tag)
+    UPSTREAM=$(terraform -chdir="$CA_TF_DIR" output -raw repository_upstream)
+    assert_equal "$OWNER_TAG" "platform"
+    assert_equal "$TEAM_TAG" "data"
+    assert_equal "$UPSTREAM" "floci-codeartifact-store"
+}
+
+@test "CodeArtifact domain/repository: DescribeDomain reports the live repository count" {
+    run aws_cmd codeartifact describe-domain --domain floci-codeartifact-domain \
+        --query "domain.repositoryCount" --output text
+    assert_success
+    assert_output "2"
+}
+
+@test "CodeArtifact domain/repository: second plan reports no changes" {
+    cd "$CA_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}
+
+@test "CodeArtifact domain/repository: GetRepositoryEndpoint resolves for a real package format" {
+    run aws_cmd codeartifact get-repository-endpoint --domain floci-codeartifact-domain \
+        --repository floci-codeartifact-consumer --format npm --query repositoryEndpoint --output text
+    assert_success
+    [[ "$output" == *"/codeartifact/npm/floci-codeartifact-domain/floci-codeartifact-consumer/"* ]]
+}

compatibility-tests/compat-terraform/test/dynamodb-kinesis-precision-tf/main.tf

@@ -0,0 +1,44 @@
+# Verifies that a DynamoDB Kinesis streaming destination keeps the precision it was created with.
+#
+# EnableKinesisStreamingDestination ignored ApproximateCreationDateTimePrecision and
+# DescribeKinesisStreamingDestination always reported MILLISECOND. The attribute is ForceNew
+# in the provider, so a MICROSECOND destination was destroyed and recreated on every apply.
+#
+# The table deliberately leaves DynamoDB Streams off: enabling the destination used to switch
+# them on, which aws_dynamodb_table then planned to switch off again on every run.
+
+variable "precision" {
+  type    = string
+  default = "MICROSECOND"
+}
+
+resource "aws_kinesis_stream" "events" {
+  name             = "floci-ddb-kinesis-precision"
+  shard_count      = 1
+  retention_period = 24
+}
+
+resource "aws_dynamodb_table" "items" {
+  name         = "floci-ddb-kinesis-precision"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "pk"
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+}
+
+resource "aws_dynamodb_kinesis_streaming_destination" "items" {
+  stream_arn                               = aws_kinesis_stream.events.arn
+  table_name                               = aws_dynamodb_table.items.name
+  approximate_creation_date_time_precision = var.precision
+}
+
+output "table_name" {
+  value = aws_dynamodb_table.items.name
+}
+
+output "stream_arn" {
+  value = aws_kinesis_stream.events.arn
+}

compatibility-tests/compat-terraform/test/dynamodb-kinesis-precision-tf/provider.tf

@@ -0,0 +1,29 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    dynamodb = var.endpoint
+    kinesis  = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/dynamodb_kinesis_precision.bats

@@ -0,0 +1,95 @@
+#!/usr/bin/env bats
+# DynamoDB Kinesis Streaming Destination Precision Compatibility Test
+#
+# EnableKinesisStreamingDestination ignored ApproximateCreationDateTimePrecision, and
+# DescribeKinesisStreamingDestination always reported MILLISECOND. The provider marks
+# approximate_creation_date_time_precision as ForceNew, so a MICROSECOND destination read back
+# as MILLISECOND and was destroyed and recreated on every apply. Enabling the destination also
+# switched on DynamoDB Streams for the table, so aws_dynamodb_table planned to turn it back off
+# on every run. This verifies the precision reads back as written, a second plan is clean for
+# both resources, and changing the precision replaces the destination once.
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    DDB_KINESIS_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/dynamodb-kinesis-precision-tf" && pwd)"
+    cd "$DDB_KINESIS_TF_DIR"
+
+    echo "# === DynamoDB Kinesis Destination Precision Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $DDB_KINESIS_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply (MICROSECOND) ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    DDB_KINESIS_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/dynamodb-kinesis-precision-tf" && pwd)"
+    cd "$DDB_KINESIS_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    DDB_KINESIS_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/dynamodb-kinesis-precision-tf" && pwd)"
+}
+
+describe_precision() {
+    local table_name stream_arn
+    table_name=$(terraform -chdir="$DDB_KINESIS_TF_DIR" output -raw table_name)
+    stream_arn=$(terraform -chdir="$DDB_KINESIS_TF_DIR" output -raw stream_arn)
+    aws_cmd dynamodb describe-kinesis-streaming-destination --table-name "$table_name" \
+        --query "KinesisDataStreamDestinations[?StreamArn=='${stream_arn}'].ApproximateCreationDateTimePrecision | [0]" \
+        --output text
+}
+
+@test "DynamoDB Kinesis precision: destination reads back as MICROSECOND" {
+    run describe_precision
+    assert_success
+    assert_output "MICROSECOND"
+}
+
+# The critical assertion: before the fix the precision read back as MILLISECOND, and because
+# the attribute is ForceNew every plan proposed replacing the destination. The table here does
+# not enable streams, so this also catches stream_enabled drift on aws_dynamodb_table.
+@test "DynamoDB Kinesis precision: second plan reports no changes" {
+    cd "$DDB_KINESIS_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}
+
+# A real precision change is still ForceNew: it must replace the destination once, then settle.
+@test "DynamoDB Kinesis precision: changing the precision replaces once and re-plans clean" {
+    cd "$DDB_KINESIS_TF_DIR"
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -var="precision=MILLISECOND" \
+        -input=false -auto-approve -no-color
+    assert_success
+    assert_output --partial "1 added, 0 changed, 1 destroyed"
+
+    run describe_precision
+    assert_success
+    assert_output "MILLISECOND"
+
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -var="precision=MILLISECOND" \
+        -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}

compatibility-tests/compat-terraform/test/elasticache-cluster-tf/main.tf

@@ -0,0 +1,26 @@
+resource "aws_elasticache_replication_group" "cluster" {
+  replication_group_id       = "floci-tf-valkey-cluster"
+  description                = "floci terraform cluster-mode compatibility test"
+  engine                     = "valkey"
+  node_type                  = "cache.t4g.micro"
+  parameter_group_name       = "default.valkey8.cluster.on"
+  automatic_failover_enabled = true
+  num_node_groups            = 2
+  replicas_per_node_group    = 1
+}
+
+output "cluster_enabled" {
+  value = aws_elasticache_replication_group.cluster.cluster_enabled
+}
+
+output "configuration_endpoint_address" {
+  value = aws_elasticache_replication_group.cluster.configuration_endpoint_address
+}
+
+output "num_node_groups" {
+  value = aws_elasticache_replication_group.cluster.num_node_groups
+}
+
+output "member_clusters" {
+  value = aws_elasticache_replication_group.cluster.member_clusters
+}

compatibility-tests/compat-terraform/test/elasticache-cluster-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    elasticache = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/elasticache_cluster.bats

@@ -0,0 +1,131 @@
+#!/usr/bin/env bats
+# ElastiCache Cluster Mode Compatibility Test
+#
+# Applies an aws_elasticache_replication_group with num_node_groups /
+# replicas_per_node_group (Terraform's cluster-mode shape) against floci and
+# verifies both sides of the contract: the terraform read-back is honest
+# (cluster_enabled, member_clusters, a clean re-plan), and the data plane is a
+# genuine Valkey cluster (CLUSTER INFO over RESP through the auth proxy).
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    EC_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/elasticache-cluster-tf" && pwd)"
+    cd "$EC_TF_DIR"
+
+    echo "# === ElastiCache Cluster Mode Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $EC_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply (2 shards, 1 replica each) ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    EC_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/elasticache-cluster-tf" && pwd)"
+    cd "$EC_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    EC_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/elasticache-cluster-tf" && pwd)"
+}
+
+# Sends one RESP command over /dev/tcp and echoes whatever the server replies
+# within the read window. No redis-cli in this image, so raw RESP it is.
+valkey_command() {
+    local host="$1" port="$2"
+    shift 2
+    local payload="*$#\r\n"
+    local arg
+    for arg in "$@"; do
+        payload+="\$${#arg}\r\n${arg}\r\n"
+    done
+    exec 9<>"/dev/tcp/${host}/${port}" || return 1
+    printf '%b' "$payload" >&9
+    local reply="" chunk
+    while IFS= read -r -t 3 -u 9 chunk; do
+        reply+="${chunk}"$'\n'
+    done
+    exec 9<&- 9>&-
+    printf '%s' "$reply"
+}
+
+@test "ElastiCache cluster mode: terraform reads back cluster_enabled=true" {
+    run terraform -chdir="$EC_TF_DIR" output -raw cluster_enabled
+    assert_success
+    assert_output "true"
+
+    run terraform -chdir="$EC_TF_DIR" output -raw num_node_groups
+    assert_success
+    assert_output "2"
+}
+
+@test "ElastiCache cluster mode: describe reports the sharded topology" {
+    run aws_cmd elasticache describe-replication-groups \
+        --replication-group-id floci-tf-valkey-cluster
+    assert_success
+    [ "$(json_get "$output" '.ReplicationGroups[0].ClusterEnabled')" = "true" ]
+    [ "$(json_get "$output" '.ReplicationGroups[0].AutomaticFailover')" = "enabled" ]
+    [ "$(json_get "$output" '.ReplicationGroups[0].Engine')" = "valkey" ]
+    [ "$(json_get "$output" '.ReplicationGroups[0].NodeGroups | length')" = "2" ]
+    [ "$(json_get "$output" '.ReplicationGroups[0].NodeGroups[0].Slots')" = "0-8191" ]
+    [ "$(json_get "$output" '.ReplicationGroups[0].NodeGroups[1].Slots')" = "8192-16383" ]
+    [ "$(json_get "$output" '.ReplicationGroups[0].MemberClusters | length')" = "4" ]
+}
+
+@test "ElastiCache cluster mode: member cache clusters answer DescribeCacheClusters" {
+    member=$(terraform -chdir="$EC_TF_DIR" output -json member_clusters | jq -r '.[0]')
+    run aws_cmd elasticache describe-cache-clusters \
+        --cache-cluster-id "$member" --show-cache-node-info
+    assert_success
+    [ "$(json_get "$output" '.CacheClusters[0].ReplicationGroupId')" = "floci-tf-valkey-cluster" ]
+    [ "$(json_get "$output" '.CacheClusters[0].Engine')" = "valkey" ]
+    [ -n "$(json_get "$output" '.CacheClusters[0].CacheNodes[0].Endpoint.Port')" ]
+}
+
+# The critical assertion: the endpoint terraform hands out fronts a Valkey
+# node that is actually running in cluster mode, in a formed, healthy cluster.
+@test "ElastiCache cluster mode: Valkey runs in cluster mode behind the configuration endpoint" {
+    host=$(terraform -chdir="$EC_TF_DIR" output -raw configuration_endpoint_address)
+    describe=$(aws_cmd elasticache describe-replication-groups \
+        --replication-group-id floci-tf-valkey-cluster)
+    port=$(json_get "$describe" '.ReplicationGroups[0].ConfigurationEndpoint.Port')
+
+    run valkey_command "$host" "$port" INFO cluster
+    assert_success
+    assert_output --partial "cluster_enabled:1"
+
+    run valkey_command "$host" "$port" CLUSTER INFO
+    assert_success
+    assert_output --partial "cluster_state:ok"
+    assert_output --partial "cluster_size:2"
+    assert_output --partial "cluster_known_nodes:4"
+}
+
+# Guards against read-back drift (the class of bug in floci-io/floci#2481):
+# a second plan straight after apply must not want to change anything.
+@test "ElastiCache cluster mode: re-plan after apply is clean" {
+    cd "$EC_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}

compatibility-tests/compat-terraform/test/eni-destroy-tf/main.tf

@@ -0,0 +1,30 @@
+# Minimal VPC + Subnet + Security Group to verify
+# terraform destroy succeeds after DescribeNetworkInterfaces fix.
+# Previously https://github.com/floci-io/floci/issues/1031
+
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = "floci-eni-destroy-vpc"
+  }
+}
+
+resource "aws_subnet" "test" {
+  vpc_id     = aws_vpc.test.id
+  cidr_block = "10.0.1.0/24"
+
+  tags = {
+    Name = "floci-eni-destroy-subnet"
+  }
+}
+
+resource "aws_security_group" "test" {
+  name        = "floci-eni-destroy-sg"
+  description = "ENI destroy test SG"
+  vpc_id      = aws_vpc.test.id
+
+  tags = {
+    Name = "floci-eni-destroy-sg"
+  }
+}

compatibility-tests/compat-terraform/test/eni-destroy-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    ec2 = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/eni_destroy.bats

@@ -0,0 +1,116 @@
+#!/usr/bin/env bats
+# ENI Destroy Compatibility Test
+#
+# Reproduces https://github.com/floci-io/floci/issues/1031
+# Terraform destroy succeeds on VPC+subnet+SG because
+# DescribeNetworkInterfaces is now implemented.
+#
+# This test verifies that terraform destroy on a VPC with
+# subnets and security groups completes without error.
+# DescribeNetworkInterfaces returns an empty ENI list when
+# no instances exist, unblocking the destroy workflow.
+#
+# FIX VERIFIED: DescribeNetworkInterfaces implemented,
+# Test now PASSES. (Previously returned UnsupportedOperation.)
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    # Override TF_DIR to the minimal eni-destroy terraform config
+    ENI_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/eni-destroy-tf" && pwd)"
+    cd "$ENI_TF_DIR"
+
+    echo "# === ENI Destroy Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $ENI_TF_DIR" >&3
+
+    # Clean any previous state
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform validate ---" >&3
+    run terraform validate -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform validate failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform plan ---" >&3
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform plan failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    ENI_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/eni-destroy-tf" && pwd)"
+    cd "$ENI_TF_DIR"
+
+    # Clean up terraform state after test
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    ENI_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/eni-destroy-tf" && pwd)"
+}
+
+# --- Spot checks: resources were created ---
+
+@test "ENI Destroy: VPC was created" {
+    run aws_cmd ec2 describe-vpcs \
+        --filters "Name=tag:Name,Values=floci-eni-destroy-vpc"
+    assert_success
+    assert_output --partial "floci-eni-destroy-vpc"
+    assert_output --partial "10.0.0.0/16"
+}
+
+@test "ENI Destroy: Subnet was created" {
+    run terraform -chdir="$ENI_TF_DIR" state show aws_subnet.test
+    assert_success
+    assert_output --partial "10.0.1.0/24"
+}
+
+@test "ENI Destroy: Security Group was created" {
+    run aws_cmd ec2 describe-security-groups \
+        --group-names "floci-eni-destroy-sg"
+    assert_success
+    assert_output --partial "floci-eni-destroy-sg"
+}
+
+# --- The critical assertion: terraform destroy must succeed ---
+#
+# Terraform destroy on a VPC with subnets/SGs calls
+# DescribeNetworkInterfaces to check for ENIs. With no
+# instances running, the response is an empty set,
+# allowing the destroy to proceed cleanly.
+
+@test "ENI Destroy: terraform destroy succeeds" {
+    cd "$ENI_TF_DIR"
+
+    echo "# --- terraform destroy ---" >&3
+    run terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+
+    assert_success
+
+    # Verify resources are actually gone
+    run aws_cmd ec2 describe-vpcs \
+        --filters "Name=tag:Name,Values=floci-eni-destroy-vpc"
+    assert_output --partial '"Vpcs": []'  # empty result = VPC deleted
+}

compatibility-tests/compat-terraform/test/kms-update-alias-tf/main.tf

@@ -0,0 +1,31 @@
+# Verifies https://github.com/floci-io/floci/issues/2291
+#
+# The Terraform AWS provider treats target_key_id on aws_kms_alias as an
+# in-place update, not a replacement. Flipping which key the alias points at
+# must therefore call UpdateAlias, not CreateAlias/DeleteAlias.
+
+resource "aws_kms_key" "a" {
+  description = "floci-kms-update-alias-test key A"
+}
+
+resource "aws_kms_key" "b" {
+  description = "floci-kms-update-alias-test key B"
+}
+
+variable "use_second_key" {
+  type    = bool
+  default = false
+}
+
+resource "aws_kms_alias" "test" {
+  name          = "alias/floci-kms-update-alias-test"
+  target_key_id = var.use_second_key ? aws_kms_key.b.key_id : aws_kms_key.a.key_id
+}
+
+output "key_a_id" {
+  value = aws_kms_key.a.key_id
+}
+
+output "key_b_id" {
+  value = aws_kms_key.b.key_id
+}

compatibility-tests/compat-terraform/test/kms-update-alias-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    kms = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/kms_update_alias.bats

@@ -0,0 +1,87 @@
+#!/usr/bin/env bats
+# KMS UpdateAlias Compatibility Test
+#
+# Reproduces https://github.com/floci-io/floci/issues/2291
+#
+# The Terraform AWS provider treats a target_key_id change on aws_kms_alias
+# as an in-place update (not a replacement), which requires the emulator to
+# support the UpdateAlias action. This verifies that re-applying with a
+# different target key updates the existing alias rather than erroring or
+# recreating it.
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    KMS_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/kms-update-alias-tf" && pwd)"
+    cd "$KMS_TF_DIR"
+
+    echo "# === KMS UpdateAlias Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $KMS_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply (alias -> key A) ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    KMS_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/kms-update-alias-tf" && pwd)"
+    cd "$KMS_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    KMS_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/kms-update-alias-tf" && pwd)"
+}
+
+@test "KMS UpdateAlias: alias initially targets key A" {
+    KEY_A=$(terraform -chdir="$KMS_TF_DIR" output -raw key_a_id)
+    run aws_cmd kms list-aliases --key-id "$KEY_A" \
+        --query "Aliases[?AliasName=='alias/floci-kms-update-alias-test'].TargetKeyId | [0]" --output text
+    assert_success
+    assert_output "$KEY_A"
+}
+
+# The critical assertion: re-applying with a different target_key_id must
+# update the existing alias in place, not destroy/recreate it and not fail.
+@test "KMS UpdateAlias: re-apply with a different target updates in place" {
+    cd "$KMS_TF_DIR"
+
+    echo "# --- terraform apply (alias -> key B) ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -var="use_second_key=true" \
+        -input=false -auto-approve -no-color
+    assert_success
+    assert_output --partial "1 changed"
+    refute_output --partial "1 destroyed"
+
+    KEY_B=$(terraform -chdir="$KMS_TF_DIR" output -raw key_b_id)
+    run aws_cmd kms list-aliases --key-id "$KEY_B" \
+        --query "Aliases[?AliasName=='alias/floci-kms-update-alias-test'].TargetKeyId | [0]" --output text
+    assert_success
+    assert_output "$KEY_B"
+}
+
+@test "KMS UpdateAlias: alias no longer resolves under key A" {
+    KEY_A=$(terraform -chdir="$KMS_TF_DIR" output -raw key_a_id)
+    run aws_cmd kms list-aliases --key-id "$KEY_A" \
+        --query "Aliases[?AliasName=='alias/floci-kms-update-alias-test']" --output text
+    assert_success
+    [ -z "$output" ]
+}

compatibility-tests/compat-terraform/test/neptune-cluster-instance-tf/main.tf

@@ -0,0 +1,69 @@
+resource "aws_neptune_cluster" "cluster" {
+  cluster_identifier  = "floci-tf-neptune-instances"
+  engine              = "neptune"
+  port                = 8183
+  skip_final_snapshot = true
+  apply_immediately   = true
+}
+
+resource "aws_neptune_cluster_instance" "writer" {
+  identifier         = "floci-tf-neptune-writer"
+  cluster_identifier = aws_neptune_cluster.cluster.id
+  instance_class     = "db.r5.large"
+  engine             = "neptune"
+  port               = 8183
+  apply_immediately  = true
+
+  tags = {
+    Name = "floci-tf-neptune-writer"
+  }
+}
+
+resource "aws_neptune_cluster_instance" "reader" {
+  identifier                 = "floci-tf-neptune-reader"
+  cluster_identifier         = aws_neptune_cluster.cluster.id
+  instance_class             = "db.r5.large"
+  engine                     = "neptune"
+  port                       = 8183
+  promotion_tier             = 2
+  auto_minor_version_upgrade = false
+  apply_immediately          = true
+
+  depends_on = [aws_neptune_cluster_instance.writer]
+}
+
+output "writer_arn" {
+  value = aws_neptune_cluster_instance.writer.arn
+}
+
+output "writer_endpoint" {
+  value = aws_neptune_cluster_instance.writer.endpoint
+}
+
+output "writer_port" {
+  value = aws_neptune_cluster_instance.writer.port
+}
+
+output "writer_is_writer" {
+  value = aws_neptune_cluster_instance.writer.writer
+}
+
+output "writer_storage_encrypted" {
+  value = aws_neptune_cluster_instance.writer.storage_encrypted
+}
+
+output "writer_parameter_group_name" {
+  value = aws_neptune_cluster_instance.writer.neptune_parameter_group_name
+}
+
+output "writer_auto_minor_version_upgrade" {
+  value = aws_neptune_cluster_instance.writer.auto_minor_version_upgrade
+}
+
+output "reader_is_writer" {
+  value = aws_neptune_cluster_instance.reader.writer
+}
+
+output "reader_promotion_tier" {
+  value = aws_neptune_cluster_instance.reader.promotion_tier
+}

compatibility-tests/compat-terraform/test/neptune-cluster-instance-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    neptune = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/neptune-cluster-tf/main.tf

@@ -0,0 +1,38 @@
+resource "aws_neptune_cluster" "cluster" {
+  cluster_identifier                  = "floci-tf-neptune"
+  engine                              = "neptune"
+  backup_retention_period             = 5
+  preferred_backup_window             = "07:00-09:00"
+  iam_database_authentication_enabled = true
+  deletion_protection                 = false
+  skip_final_snapshot                 = true
+  apply_immediately                   = true
+
+  tags = {
+    Name = "floci-tf-neptune"
+  }
+}
+
+output "cluster_arn" {
+  value = aws_neptune_cluster.cluster.arn
+}
+
+output "cluster_resource_id" {
+  value = aws_neptune_cluster.cluster.cluster_resource_id
+}
+
+output "endpoint" {
+  value = aws_neptune_cluster.cluster.endpoint
+}
+
+output "port" {
+  value = aws_neptune_cluster.cluster.port
+}
+
+output "storage_encrypted" {
+  value = aws_neptune_cluster.cluster.storage_encrypted
+}
+
+output "parameter_group_name" {
+  value = aws_neptune_cluster.cluster.neptune_cluster_parameter_group_name
+}

compatibility-tests/compat-terraform/test/neptune-cluster-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    neptune = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/neptune_cluster.bats

@@ -0,0 +1,90 @@
+#!/usr/bin/env bats
+# Neptune Cluster Compatibility Test
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    NEPTUNE_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/neptune-cluster-tf" && pwd)"
+    cd "$NEPTUNE_TF_DIR"
+
+    echo "# === Neptune Cluster Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $NEPTUNE_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    NEPTUNE_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/neptune-cluster-tf" && pwd)"
+    cd "$NEPTUNE_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    NEPTUNE_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/neptune-cluster-tf" && pwd)"
+}
+
+@test "Neptune cluster: terraform reads back the attributes it manages" {
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw storage_encrypted
+    assert_success
+    assert_output "false"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw parameter_group_name
+    assert_success
+    assert_output "default.neptune1.3"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw port
+    assert_success
+    assert_output "8182"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw cluster_arn
+    assert_success
+    assert_output --partial ":cluster:floci-tf-neptune"
+}
+
+@test "Neptune cluster: describe reports the configured settings" {
+    run aws_cmd neptune describe-db-clusters --db-cluster-identifier floci-tf-neptune
+    assert_success
+    [ "$(json_get "$output" '.DBClusters[0].Engine')" = "neptune" ]
+    [ "$(json_get "$output" '.DBClusters[0].Status')" = "available" ]
+    [ "$(json_get "$output" '.DBClusters[0].BackupRetentionPeriod')" = "5" ]
+    [ "$(json_get "$output" '.DBClusters[0].PreferredBackupWindow')" = "07:00-09:00" ]
+    [ "$(json_get "$output" '.DBClusters[0].StorageEncrypted')" = "false" ]
+    [ "$(json_get "$output" '.DBClusters[0].DeletionProtection')" = "false" ]
+    [ "$(json_get "$output" '.DBClusters[0].IAMDatabaseAuthenticationEnabled')" = "true" ]
+    [ "$(json_get "$output" '.DBClusters[0].DBClusterParameterGroup')" = "default.neptune1.3" ]
+    [ "$(json_get "$output" '.DBClusters[0].AvailabilityZones | length')" = "1" ]
+}
+
+@test "Neptune cluster: tags round-trip through ListTagsForResource" {
+    arn=$(terraform -chdir="$NEPTUNE_TF_DIR" output -raw cluster_arn)
+    run aws_cmd neptune list-tags-for-resource --resource-name "$arn"
+    assert_success
+    [ "$(json_get "$output" '.TagList[] | select(.Key == "Name") | .Value')" = "floci-tf-neptune" ]
+}
+
+@test "Neptune cluster: re-plan after apply is clean" {
+    cd "$NEPTUNE_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}

compatibility-tests/compat-terraform/test/neptune_cluster_instance.bats

@@ -0,0 +1,115 @@
+#!/usr/bin/env bats
+# Neptune Cluster Instance Compatibility Test
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    NEPTUNE_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/neptune-cluster-instance-tf" && pwd)"
+    cd "$NEPTUNE_TF_DIR"
+
+    echo "# === Neptune Cluster Instance Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $NEPTUNE_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    NEPTUNE_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/neptune-cluster-instance-tf" && pwd)"
+    cd "$NEPTUNE_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    NEPTUNE_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/neptune-cluster-instance-tf" && pwd)"
+}
+
+@test "Neptune cluster instance: terraform reads back the attributes it manages" {
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_is_writer
+    assert_success
+    assert_output "true"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw reader_is_writer
+    assert_success
+    assert_output "false"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_storage_encrypted
+    assert_success
+    assert_output "false"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_parameter_group_name
+    assert_success
+    assert_output "default.neptune1.3"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_port
+    assert_success
+    assert_output "8183"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_auto_minor_version_upgrade
+    assert_success
+    assert_output "true"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw reader_promotion_tier
+    assert_success
+    assert_output "2"
+
+    run terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_endpoint
+    assert_success
+    assert_output --partial ":8183"
+}
+
+@test "Neptune cluster instance: describe reports the configured settings" {
+    run aws_cmd neptune describe-db-instances --db-instance-identifier floci-tf-neptune-reader
+    assert_success
+    [ "$(json_get "$output" '.DBInstances[0].DBClusterIdentifier')" = "floci-tf-neptune-instances" ]
+    [ "$(json_get "$output" '.DBInstances[0].DBInstanceClass')" = "db.r5.large" ]
+    [ "$(json_get "$output" '.DBInstances[0].DBInstanceStatus')" = "available" ]
+    [ "$(json_get "$output" '.DBInstances[0].Endpoint.Port')" = "8183" ]
+    [ "$(json_get "$output" '.DBInstances[0].PromotionTier')" = "2" ]
+    [ "$(json_get "$output" '.DBInstances[0].AutoMinorVersionUpgrade')" = "false" ]
+    [ "$(json_get "$output" '.DBInstances[0].PubliclyAccessible')" = "false" ]
+    [ "$(json_get "$output" '.DBInstances[0].StorageEncrypted')" = "false" ]
+    [ "$(json_get "$output" '.DBInstances[0].DBSubnetGroup.DBSubnetGroupName')" = "default" ]
+    [ "$(json_get "$output" '.DBInstances[0].DBParameterGroups[0].DBParameterGroupName')" = "default.neptune1.3" ]
+}
+
+@test "Neptune cluster instance: tags round-trip through ListTagsForResource" {
+    arn=$(terraform -chdir="$NEPTUNE_TF_DIR" output -raw writer_arn)
+    run aws_cmd neptune list-tags-for-resource --resource-name "$arn"
+    assert_success
+    [ "$(json_get "$output" '.TagList[] | select(.Key == "Name") | .Value')" = "floci-tf-neptune-writer" ]
+}
+
+@test "Neptune cluster instance: the cluster reports exactly one writer" {
+    run aws_cmd neptune describe-db-clusters --db-cluster-identifier floci-tf-neptune-instances
+    assert_success
+    [ "$(json_get "$output" '.DBClusters[0].DBClusterMembers | length')" = "2" ]
+    [ "$(json_get "$output" '[.DBClusters[0].DBClusterMembers[] | select(.IsClusterWriter)] | length')" = "1" ]
+    [ "$(json_get "$output" '.DBClusters[0].DBClusterMembers[] | select(.IsClusterWriter) | .DBInstanceIdentifier')" = "floci-tf-neptune-writer" ]
+}
+
+@test "Neptune cluster instance: re-plan after apply is clean" {
+    cd "$NEPTUNE_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}

compatibility-tests/compat-terraform/test/rds-proxy-network-type-tf/main.tf

@@ -0,0 +1,148 @@
+# Verifies aws_db_proxy's endpoint_network_type/target_connection_network_type round-trip
+# through CreateDBProxy/DescribeDBProxies instead of being rejected outright. AWS requires both
+# the VPC and every selected subnet to carry an IPv6 CIDR block for IPV6/DUAL (see
+# https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-network-prereqs.html), so this
+# VPC and its subnets are genuinely dual-stack; see rds_proxy_network_type.bats for the companion
+# negative case against an IPv4-only VPC.
+
+resource "aws_vpc" "proxy" {
+  cidr_block                       = "10.80.0.0/16"
+  assign_generated_ipv6_cidr_block = true
+
+  tags = {
+    Name = "floci-rds-proxy-network-type"
+  }
+}
+
+resource "aws_subnet" "a" {
+  vpc_id            = aws_vpc.proxy.id
+  cidr_block        = "10.80.1.0/24"
+  ipv6_cidr_block   = cidrsubnet(aws_vpc.proxy.ipv6_cidr_block, 8, 0)
+  availability_zone = "us-east-1a"
+}
+
+resource "aws_subnet" "b" {
+  vpc_id            = aws_vpc.proxy.id
+  cidr_block        = "10.80.2.0/24"
+  ipv6_cidr_block   = cidrsubnet(aws_vpc.proxy.ipv6_cidr_block, 8, 1)
+  availability_zone = "us-east-1b"
+}
+
+resource "aws_security_group" "proxy" {
+  name   = "floci-rds-proxy-network-type"
+  vpc_id = aws_vpc.proxy.id
+}
+
+resource "aws_secretsmanager_secret" "db" {
+  name = "floci-rds-proxy-network-type-secret"
+}
+
+resource "aws_secretsmanager_secret_version" "db" {
+  secret_id     = aws_secretsmanager_secret.db.id
+  secret_string = jsonencode({ username = "app", password = "changeme123!" })
+}
+
+resource "aws_iam_role" "proxy" {
+  name = "floci-rds-proxy-network-type-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action    = "sts:AssumeRole"
+      Effect    = "Allow"
+      Principal = { Service = "rds.amazonaws.com" }
+    }]
+  })
+}
+
+# IPv4-only sibling VPC/subnets: the negative case in rds_proxy_network_type.bats asserts a
+# direct CreateDBProxy against these with EndpointNetworkType=DUAL is rejected, since AWS
+# requires the VPC to have an IPv6 CIDR block for that.
+resource "aws_vpc" "ipv4_only" {
+  cidr_block = "10.90.0.0/16"
+
+  tags = {
+    Name = "floci-rds-proxy-network-type-ipv4-only"
+  }
+}
+
+resource "aws_subnet" "ipv4_only_a" {
+  vpc_id            = aws_vpc.ipv4_only.id
+  cidr_block        = "10.90.1.0/24"
+  availability_zone = "us-east-1a"
+}
+
+resource "aws_subnet" "ipv4_only_b" {
+  vpc_id            = aws_vpc.ipv4_only.id
+  cidr_block        = "10.90.2.0/24"
+  availability_zone = "us-east-1b"
+}
+
+# Dual-stack VPC whose subnets never got an IPv6 CIDR block: the negative case in
+# rds_proxy_network_type.bats asserts a direct CreateDBProxy against these with
+# EndpointNetworkType=DUAL is still rejected, since AWS requires every selected subnet -- not
+# just the VPC -- to carry an IPv6 CIDR block.
+resource "aws_vpc" "ipv6_subnets_missing" {
+  cidr_block                       = "10.100.0.0/16"
+  assign_generated_ipv6_cidr_block = true
+
+  tags = {
+    Name = "floci-rds-proxy-network-type-ipv6-subnets-missing"
+  }
+}
+
+resource "aws_subnet" "ipv6_subnets_missing_a" {
+  vpc_id            = aws_vpc.ipv6_subnets_missing.id
+  cidr_block        = "10.100.1.0/24"
+  availability_zone = "us-east-1a"
+}
+
+resource "aws_subnet" "ipv6_subnets_missing_b" {
+  vpc_id            = aws_vpc.ipv6_subnets_missing.id
+  cidr_block        = "10.100.2.0/24"
+  availability_zone = "us-east-1b"
+}
+
+resource "aws_db_proxy" "test" {
+  name                           = "floci-rds-proxy-network-type"
+  engine_family                  = "MYSQL"
+  role_arn                       = aws_iam_role.proxy.arn
+  vpc_subnet_ids                 = [aws_subnet.a.id, aws_subnet.b.id]
+  vpc_security_group_ids         = [aws_security_group.proxy.id]
+  endpoint_network_type          = "DUAL"
+  target_connection_network_type = "IPV6"
+
+  auth {
+    auth_scheme = "SECRETS"
+    iam_auth    = "DISABLED"
+    secret_arn  = aws_secretsmanager_secret.db.arn
+  }
+}
+
+output "proxy_arn" {
+  value = aws_db_proxy.test.arn
+}
+
+output "endpoint_network_type" {
+  value = aws_db_proxy.test.endpoint_network_type
+}
+
+output "target_connection_network_type" {
+  value = aws_db_proxy.test.target_connection_network_type
+}
+
+output "role_arn" {
+  value = aws_iam_role.proxy.arn
+}
+
+output "secret_arn" {
+  value = aws_secretsmanager_secret.db.arn
+}
+
+output "ipv4_only_subnet_ids" {
+  value = [aws_subnet.ipv4_only_a.id, aws_subnet.ipv4_only_b.id]
+}
+
+output "ipv6_subnets_missing_subnet_ids" {
+  value = [aws_subnet.ipv6_subnets_missing_a.id, aws_subnet.ipv6_subnets_missing_b.id]
+}

compatibility-tests/compat-terraform/test/rds-proxy-network-type-tf/provider.tf

@@ -0,0 +1,31 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    rds            = var.endpoint
+    ec2            = var.endpoint
+    iam            = var.endpoint
+    secretsmanager = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/rds-snapshot-tags-tf/main.tf

@@ -0,0 +1,35 @@
+# Verifies aws_db_snapshot tags round-trip through CreateDBSnapshot/TagResource/DescribeDBSnapshots
+# instead of TagResource rejecting the snapshot ARN outright ("not yet implemented by Floci").
+
+resource "aws_db_instance" "source" {
+  identifier          = "floci-rds-snapshot-tags-source"
+  engine              = "postgres"
+  engine_version      = "16"
+  instance_class      = "db.t3.micro"
+  allocated_storage   = 20
+  username            = "app"
+  password            = "changeme123!"
+  skip_final_snapshot = true
+}
+
+variable "owner_tag" {
+  type    = string
+  default = "platform"
+}
+
+resource "aws_db_snapshot" "test" {
+  db_instance_identifier = aws_db_instance.source.identifier
+  db_snapshot_identifier = "floci-rds-snapshot-tags-snap"
+
+  tags = {
+    owner = var.owner_tag
+  }
+}
+
+output "db_snapshot_arn" {
+  value = aws_db_snapshot.test.db_snapshot_arn
+}
+
+output "owner_tag" {
+  value = aws_db_snapshot.test.tags["owner"]
+}

compatibility-tests/compat-terraform/test/rds-snapshot-tags-tf/provider.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  s3_use_path_style           = true
+
+  endpoints {
+    rds = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/rds_proxy_network_type.bats

@@ -0,0 +1,116 @@
+#!/usr/bin/env bats
+# RDS Proxy EndpointNetworkType/TargetConnectionNetworkType Compatibility Test
+#
+# CreateDBProxy used to reject any EndpointNetworkType/TargetConnectionNetworkType other than
+# IPV4 outright. This verifies aws_db_proxy can apply with endpoint_network_type = "DUAL" and
+# target_connection_network_type = "IPV6", that DescribeDBProxies reads the values back, and
+# that a second plan is clean (no perpetual diff from a default the provider disagrees with).
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    PROXY_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/rds-proxy-network-type-tf" && pwd)"
+    cd "$PROXY_TF_DIR"
+
+    echo "# === RDS Proxy Network Type Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $PROXY_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    PROXY_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/rds-proxy-network-type-tf" && pwd)"
+    cd "$PROXY_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    PROXY_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/rds-proxy-network-type-tf" && pwd)"
+}
+
+@test "RDS Proxy network type: apply reports DUAL/IPV6 outputs" {
+    ENDPOINT_TYPE=$(terraform -chdir="$PROXY_TF_DIR" output -raw endpoint_network_type)
+    TARGET_TYPE=$(terraform -chdir="$PROXY_TF_DIR" output -raw target_connection_network_type)
+    assert_equal "$ENDPOINT_TYPE" "DUAL"
+    assert_equal "$TARGET_TYPE" "IPV6"
+}
+
+@test "RDS Proxy network type: DescribeDBProxies reads the values back" {
+    run aws_cmd rds describe-db-proxies --db-proxy-name floci-rds-proxy-network-type \
+        --query "DBProxies[0].EndpointNetworkType" --output text
+    assert_success
+    assert_output "DUAL"
+
+    run aws_cmd rds describe-db-proxies --db-proxy-name floci-rds-proxy-network-type \
+        --query "DBProxies[0].TargetConnectionNetworkType" --output text
+    assert_success
+    assert_output "IPV6"
+}
+
+@test "RDS Proxy network type: second plan reports no changes" {
+    cd "$PROXY_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}
+
+@test "RDS Proxy network type: CreateDBProxy rejects DUAL against an IPv4-only VPC" {
+    ROLE_ARN=$(terraform -chdir="$PROXY_TF_DIR" output -raw role_arn)
+    SECRET_ARN=$(terraform -chdir="$PROXY_TF_DIR" output -raw secret_arn)
+    SUBNET_A=$(terraform -chdir="$PROXY_TF_DIR" output -json ipv4_only_subnet_ids | jq -r '.[0]')
+    SUBNET_B=$(terraform -chdir="$PROXY_TF_DIR" output -json ipv4_only_subnet_ids | jq -r '.[1]')
+
+    run aws_cmd rds create-db-proxy \
+        --db-proxy-name floci-rds-proxy-ipv4-only-rejected \
+        --engine-family MYSQL \
+        --role-arn "$ROLE_ARN" \
+        --vpc-subnet-ids "$SUBNET_A" "$SUBNET_B" \
+        --auth "AuthScheme=SECRETS,SecretArn=${SECRET_ARN},IAMAuth=DISABLED" \
+        --endpoint-network-type DUAL
+    assert_failure
+    assert_output --partial "IPv6 CIDR block"
+
+    run aws_cmd rds describe-db-proxies --db-proxy-name floci-rds-proxy-ipv4-only-rejected
+    assert_failure
+}
+
+@test "RDS Proxy network type: CreateDBProxy rejects DUAL when the VPC is dual-stack but the subnets are not" {
+    ROLE_ARN=$(terraform -chdir="$PROXY_TF_DIR" output -raw role_arn)
+    SECRET_ARN=$(terraform -chdir="$PROXY_TF_DIR" output -raw secret_arn)
+    SUBNET_A=$(terraform -chdir="$PROXY_TF_DIR" output -json ipv6_subnets_missing_subnet_ids | jq -r '.[0]')
+    SUBNET_B=$(terraform -chdir="$PROXY_TF_DIR" output -json ipv6_subnets_missing_subnet_ids | jq -r '.[1]')
+
+    run aws_cmd rds create-db-proxy \
+        --db-proxy-name floci-rds-proxy-ipv6-subnets-missing-rejected \
+        --engine-family MYSQL \
+        --role-arn "$ROLE_ARN" \
+        --vpc-subnet-ids "$SUBNET_A" "$SUBNET_B" \
+        --auth "AuthScheme=SECRETS,SecretArn=${SECRET_ARN},IAMAuth=DISABLED" \
+        --endpoint-network-type DUAL
+    assert_failure
+    assert_output --partial "VpcSubnetIds"
+    assert_output --partial "IPv6 CIDR block"
+
+    run aws_cmd rds describe-db-proxies --db-proxy-name floci-rds-proxy-ipv6-subnets-missing-rejected
+    assert_failure
+}

compatibility-tests/compat-terraform/test/rds_snapshot_tags.bats

@@ -0,0 +1,85 @@
+#!/usr/bin/env bats
+# RDS DB Snapshot Tagging Compatibility Test
+#
+# TagResource/UntagResource used to reject a snapshot ARN outright ("not yet implemented by
+# Floci"), and CreateDBSnapshot silently dropped its Tags parameter. This verifies aws_db_snapshot
+# can apply with tags, that DescribeDBSnapshots reads them back (both DBSnapshotArn and TagList),
+# that a second plan is clean, and that changing a tag updates in place rather than replacing.
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    SNAP_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/rds-snapshot-tags-tf" && pwd)"
+    cd "$SNAP_TF_DIR"
+
+    echo "# === RDS Snapshot Tagging Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $SNAP_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    SNAP_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/rds-snapshot-tags-tf" && pwd)"
+    cd "$SNAP_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    SNAP_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/rds-snapshot-tags-tf" && pwd)"
+}
+
+@test "RDS snapshot tags: apply reports a snapshot ARN pinned to the provider's region" {
+    ARN=$(terraform -chdir="$SNAP_TF_DIR" output -raw db_snapshot_arn)
+    OWNER=$(terraform -chdir="$SNAP_TF_DIR" output -raw owner_tag)
+    # Exact match, not a wildcard: us-east-1 is also the default region, so a wildcard here would miss a regression.
+    assert_equal "$ARN" "arn:aws:rds:us-east-1:000000000000:snapshot:floci-rds-snapshot-tags-snap"
+    assert_equal "$OWNER" "platform"
+}
+
+@test "RDS snapshot tags: DescribeDBSnapshots reads the tag back" {
+    run aws_cmd rds describe-db-snapshots --db-snapshot-identifier floci-rds-snapshot-tags-snap \
+        --query "DBSnapshots[0].TagList[?Key=='owner'].Value | [0]" --output text
+    assert_success
+    assert_output "platform"
+}
+
+@test "RDS snapshot tags: second plan reports no changes" {
+    cd "$SNAP_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    assert_success
+    assert_output --partial "No changes"
+}
+
+@test "RDS snapshot tags: changing a tag updates in place, not a replacement" {
+    cd "$SNAP_TF_DIR"
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -var="owner_tag=data-team" \
+        -input=false -auto-approve -no-color
+    assert_success
+    assert_output --partial "1 changed"
+    refute_output --partial "1 destroyed"
+
+    run aws_cmd rds describe-db-snapshots --db-snapshot-identifier floci-rds-snapshot-tags-snap \
+        --query "DBSnapshots[0].TagList[?Key=='owner'].Value | [0]" --output text
+    assert_success
+    assert_output "data-team"
+}

compatibility-tests/compat-terraform/test/security-group-rule-sources-tf/main.tf

@@ -0,0 +1,93 @@
+# Regression coverage for #2266 at the Terraform layer.
+#
+# "Allow traffic from security group X" is how one tier is wired to another -- an ALB
+# to its backend tasks, an application to its database, a cluster to itself. When
+# AuthorizeSecurityGroupIngress dropped the source, the provider's create-wait could
+# not find the rule it had just made and the apply failed with
+# "couldn't find resource"; a response that reported the rule but lost the reference
+# would instead apply cleanly and then show as drift on every subsequent plan.
+#
+# Both of the standard spellings are exercised, because they read the source back
+# through different APIs: aws_security_group_rule polls DescribeSecurityGroups, and
+# aws_vpc_security_group_ingress_rule polls DescribeSecurityGroupRules.
+
+resource "aws_vpc" "sg_sources" {
+  cidr_block = "10.71.0.0/16"
+
+  tags = {
+    Name = "floci-sg-rule-sources"
+  }
+}
+
+resource "aws_security_group" "alb" {
+  name        = "floci-sg-rule-sources-alb"
+  description = "Front tier"
+  vpc_id      = aws_vpc.sg_sources.id
+}
+
+resource "aws_security_group" "backend" {
+  name        = "floci-sg-rule-sources-backend"
+  description = "Back tier, reachable only from the front tier"
+  vpc_id      = aws_vpc.sg_sources.id
+}
+
+# The classic spelling: reads its source back off DescribeSecurityGroups.
+resource "aws_security_group_rule" "backend_from_alb" {
+  type                     = "ingress"
+  from_port                = 8080
+  to_port                  = 8080
+  protocol                 = "tcp"
+  security_group_id        = aws_security_group.backend.id
+  source_security_group_id = aws_security_group.alb.id
+  description              = "app traffic from the load balancer"
+}
+
+# Self-reference: a cluster whose members talk to each other. This is the shape that
+# fails first, because the group is both the rule's owner and its source.
+resource "aws_security_group_rule" "backend_self" {
+  type              = "ingress"
+  from_port         = 0
+  to_port           = 0
+  protocol          = "-1"
+  security_group_id = aws_security_group.backend.id
+  self              = true
+  description       = "intra-cluster traffic"
+}
+
+# The current spelling: reads its source back off DescribeSecurityGroupRules, and
+# needs referencedGroupInfo rather than a UserIdGroupPair.
+resource "aws_vpc_security_group_ingress_rule" "backend_from_alb_v2" {
+  security_group_id            = aws_security_group.backend.id
+  referenced_security_group_id = aws_security_group.alb.id
+  from_port                    = 9090
+  to_port                      = 9090
+  ip_protocol                  = "tcp"
+  description                  = "admin traffic from the load balancer"
+}
+
+# A CIDR rule alongside them: the reference must not be lost when a group carries
+# both kinds, and a CIDR rule must not sprout a phantom reference.
+resource "aws_vpc_security_group_ingress_rule" "backend_from_cidr" {
+  security_group_id = aws_security_group.backend.id
+  cidr_ipv4         = "10.71.0.0/16"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "https from inside the vpc"
+}
+
+output "alb_sg_id" {
+  value = aws_security_group.alb.id
+}
+
+output "backend_sg_id" {
+  value = aws_security_group.backend.id
+}
+
+output "backend_from_alb_v2_rule_id" {
+  value = aws_vpc_security_group_ingress_rule.backend_from_alb_v2.security_group_rule_id
+}
+
+output "backend_from_cidr_rule_id" {
+  value = aws_vpc_security_group_ingress_rule.backend_from_cidr.security_group_rule_id
+}

compatibility-tests/compat-terraform/test/security-group-rule-sources-tf/provider.tf

@@ -0,0 +1,35 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  s3_use_path_style           = true
+
+  # Deliberately NOT skip_requesting_account_id. The provider renders a same-account
+  # referenced_security_group_id as a bare group id and a cross-account one as
+  # "<account>/<group>", and it tells them apart by comparing ReferencedGroupInfo.UserId
+  # against its own resolved account. Skipping account resolution leaves that unknown,
+  # so every same-account reference reads back as cross-account and the plan never
+  # converges. Floci answers STS GetCallerIdentity, so there is nothing to skip.
+
+  endpoints {
+    ec2 = var.endpoint
+    sts = var.endpoint
+  }
+}

compatibility-tests/compat-terraform/test/security_group_rule_sources.bats

@@ -0,0 +1,130 @@
+#!/usr/bin/env bats
+# Security Group Rule Sources Compatibility Test
+#
+# Terraform-layer regression coverage for
+# https://github.com/floci-io/floci/issues/2266
+#
+# The fix is already covered by Ec2SecurityGroupRuleSourcesIntegrationTest and by an
+# AWS CLI case in sdk-test-awscli. This adds the layer where the bug actually bit:
+# the Terraform provider polls for the rule it just created and fails the apply when
+# it cannot find it, which no API-level assertion reproduces. It also pins the
+# quieter half of the same bug -- a rule that comes back without its source applies
+# cleanly and then shows as drift on every later plan, which only an empty re-plan
+# catches.
+#
+# This config has its own provider.tf rather than reusing the module's, because it
+# must NOT set skip_requesting_account_id. See the comment there: skipping account
+# resolution makes every same-account group reference read back as cross-account, and
+# the re-plan assertion below fails for a reason that has nothing to do with #2266.
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    SG_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/security-group-rule-sources-tf" && pwd)"
+    cd "$SG_TF_DIR"
+
+    echo "# === Security Group Rule Sources Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+    echo "# Config: $SG_TF_DIR" >&3
+
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    # This apply is itself the primary assertion. Before #2266 it failed with
+    # "waiting for Security Group Rule create: couldn't find resource".
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    SG_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/security-group-rule-sources-tf" && pwd)"
+    cd "$SG_TF_DIR"
+
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+}
+
+setup() {
+    load 'test_helper/common-setup'
+    SG_TF_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/security-group-rule-sources-tf" && pwd)"
+}
+
+@test "SG rule sources: applying a config with group-referencing rules succeeds" {
+    # setup_file returns non-zero if the apply failed, which fails every test in the
+    # file. Asserting the resulting state here makes the cause obvious in the output.
+    run terraform -chdir="$SG_TF_DIR" state list
+    assert_success
+    assert_output --partial "aws_security_group_rule.backend_from_alb"
+    assert_output --partial "aws_security_group_rule.backend_self"
+    assert_output --partial "aws_vpc_security_group_ingress_rule.backend_from_alb_v2"
+}
+
+@test "SG rule sources: DescribeSecurityGroups reports the referencing group" {
+    ALB=$(terraform -chdir="$SG_TF_DIR" output -raw alb_sg_id)
+    BACKEND=$(terraform -chdir="$SG_TF_DIR" output -raw backend_sg_id)
+
+    run aws_cmd ec2 describe-security-groups --group-ids "$BACKEND" \
+        --query "SecurityGroups[0].IpPermissions[?FromPort==\`8080\`].UserIdGroupPairs[0].GroupId | [0]" \
+        --output text
+    assert_success
+    assert_output "$ALB"
+}
+
+@test "SG rule sources: a self-referencing rule keeps its own group as the source" {
+    BACKEND=$(terraform -chdir="$SG_TF_DIR" output -raw backend_sg_id)
+
+    run aws_cmd ec2 describe-security-groups --group-ids "$BACKEND" \
+        --query "SecurityGroups[0].IpPermissions[?IpProtocol=='-1'].UserIdGroupPairs[0].GroupId | [0]" \
+        --output text
+    assert_success
+    assert_output "$BACKEND"
+}
+
+@test "SG rule sources: DescribeSecurityGroupRules reports referencedGroupInfo" {
+    ALB=$(terraform -chdir="$SG_TF_DIR" output -raw alb_sg_id)
+    RULE_ID=$(terraform -chdir="$SG_TF_DIR" output -raw backend_from_alb_v2_rule_id)
+
+    run aws_cmd ec2 describe-security-group-rules --security-group-rule-ids "$RULE_ID" \
+        --query "SecurityGroupRules[0].ReferencedGroupInfo.GroupId" --output text
+    assert_success
+    assert_output "$ALB"
+}
+
+@test "SG rule sources: a CIDR rule keeps its CIDR and gains no phantom reference" {
+    RULE_ID=$(terraform -chdir="$SG_TF_DIR" output -raw backend_from_cidr_rule_id)
+
+    run aws_cmd ec2 describe-security-group-rules --security-group-rule-ids "$RULE_ID" \
+        --query "SecurityGroupRules[0].CidrIpv4" --output text
+    assert_success
+    assert_output "10.71.0.0/16"
+
+    run aws_cmd ec2 describe-security-group-rules --security-group-rule-ids "$RULE_ID" \
+        --query "SecurityGroupRules[0].ReferencedGroupInfo" --output text
+    assert_success
+    assert_output "None"
+}
+
+# The assertion a successful apply cannot make. A response that reports the rule but
+# loses its source still applies cleanly; it only surfaces later, as a plan that never
+# converges. Scoped to this configuration, which is self-contained.
+@test "SG rule sources: re-planning reports no changes" {
+    cd "$SG_TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    if [ "$status" -eq 2 ]; then
+        echo "# drift detected on re-plan:" >&3
+        echo "$output" >&3
+    fi
+    [ "$status" -eq 0 ]
+}

compatibility-tests/compat-terraform/test/terraform.bats

@@ -0,0 +1,648 @@
+#!/usr/bin/env bats
+# Terraform Compatibility Tests for floci
+
+setup_file() {
+    load 'test_helper/common-setup'
+
+    cd "$TF_DIR"
+
+    echo "# === Terraform Compatibility Test ===" >&3
+    echo "# Endpoint: $FLOCI_ENDPOINT" >&3
+
+    # Clean any previous state
+    rm -rf .terraform .terraform.lock.hcl terraform.tfstate* 2>/dev/null || true
+
+    echo "# --- Setup: state bucket & lock table ---" >&3
+    create_state_backend
+    generate_backend_config
+
+    # 12 MiB source for aws_s3_object.large: above the provider's 5 MiB part size, so it goes multipart
+    head -c $((12 * 1024 * 1024)) /dev/urandom > "$TF_DIR/large-object.bin"
+
+    echo "# --- terraform init ---" >&3
+    run terraform init -backend-config=/tmp/floci-backend.hcl \
+        -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform init failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform validate ---" >&3
+    run terraform validate -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform validate failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform plan ---" >&3
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform plan failed: $output" >&3
+        return 1
+    fi
+
+    echo "# --- terraform apply ---" >&3
+    run terraform apply -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color
+    if [ "$status" -ne 0 ]; then
+        echo "# terraform apply failed: $output" >&3
+        return 1
+    fi
+}
+
+teardown_file() {
+    load 'test_helper/common-setup'
+
+    cd "$TF_DIR"
+
+    echo "# --- terraform destroy ---" >&3
+    terraform destroy -var="endpoint=${FLOCI_ENDPOINT}" -input=false -auto-approve -no-color || true
+    rm -f "$TF_DIR/large-object.bin"
+}
+
+setup() {
+    load 'test_helper/common-setup'
+}
+
+# --- Spot Checks ---
+
+@test "Terraform: S3 bucket created" {
+    run aws_cmd s3api head-bucket --bucket floci-compat-app
+    assert_success
+}
+
+# Base64 of a hex SHA256 digest, the way S3 encodes checksums.
+hex_to_b64() {
+    printf "$(echo "$1" | sed 's/../\\x&/g')" | base64 | tr -d '\n'
+}
+
+# The composite SHA256 S3 stores for a multipart object: cut the local file at the part sizes S3
+# reports, hash each part, hash the concatenated binary digests and append the part count.
+sha256_composite_by_sizes() {
+    local file="$1"
+    shift
+    local joined offset=0 count=0 size hex
+    joined=$(mktemp)
+    for size in "$@"; do
+        hex=$(tail -c +$((offset + 1)) "$file" | head -c "$size" | sha256sum | cut -c1-64)
+        printf "$(echo "$hex" | sed 's/../\\x&/g')" >> "$joined"
+        offset=$((offset + size))
+        count=$((count + 1))
+    done
+    echo "$(hex_to_b64 "$(sha256sum "$joined" | cut -c1-64)")-$count"
+    rm -f "$joined"
+}
+
+@test "Terraform: large aws_s3_object is multipart-uploaded with the composite SHA256 checksum" {
+    run aws_cmd s3api head-object --bucket floci-compat-app --key large/multipart.bin \
+        --checksum-mode ENABLED --output json
+    assert_success
+    local checksum type etag
+    checksum=$(echo "$output" | jq -r '.ChecksumSHA256')
+    type=$(echo "$output" | jq -r '.ChecksumType')
+    etag=$(echo "$output" | jq -r '.ETag')
+    [ "$type" = "COMPOSITE" ]
+    [[ "$etag" =~ -[0-9]+\"$ ]]
+
+    run aws_cmd s3api get-object-attributes --bucket floci-compat-app --key large/multipart.bin \
+        --object-attributes Checksum ObjectParts --output json
+    assert_success
+    [ "$(echo "$output" | jq -r '.ObjectParts.TotalPartsCount')" -gt 1 ]
+    local sizes expected
+    sizes=$(echo "$output" | jq -r '.ObjectParts.Parts[].Size')
+    expected=$(sha256_composite_by_sizes "$TF_DIR/large-object.bin" $sizes)
+    [ "$checksum" = "$expected" ]
+    # GetObjectAttributes reports the composite without the part-count suffix
+    [ "$(echo "$output" | jq -r '.Checksum.ChecksumSHA256')" = "${expected%-*}" ]
+}
+
+@test "Terraform: state holds the composite checksum S3 reports for the large object" {
+    cd "$TF_DIR"
+    run terraform output -raw large_object_checksum_sha256
+    assert_success
+    local head_checksum
+    head_checksum=$(aws_cmd s3api head-object --bucket floci-compat-app --key large/multipart.bin \
+        --checksum-mode ENABLED --output json | jq -r '.ChecksumSHA256')
+    [ "$output" = "$head_checksum" ]
+}
+
+@test "Terraform: re-planning the large object reports no changes" {
+    cd "$TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode \
+        -target=aws_s3_object.large
+    if [ "$status" -eq 2 ]; then
+        echo "# drift detected on re-plan:" >&3
+        echo "$output" >&3
+    fi
+    [ "$status" -eq 0 ]
+}
+
+@test "Terraform: SQS queue created" {
+    run aws_cmd sqs get-queue-url --queue-name floci-compat-jobs
+    assert_success
+    assert_output --partial "QueueUrl"
+}
+
+@test "Terraform: SNS topic created" {
+    run aws_cmd sns list-topics
+    assert_success
+    assert_output --partial "floci-compat-events"
+}
+
+@test "Terraform: SES receipt filter created" {
+    run aws_cmd ses list-receipt-filters
+    assert_success
+    assert_output --partial "floci-compat-filter"
+    assert_output --partial "10.10.10.0/24"
+}
+
+@test "Terraform: SES receipt rule set created and active" {
+    run aws_cmd ses describe-receipt-rule-set --rule-set-name floci-compat-rule-set
+    assert_success
+    assert_output --partial "floci-compat-rule-set"
+
+    run aws_cmd ses describe-active-receipt-rule-set
+    assert_success
+    assert_output --partial "floci-compat-rule-set"
+    assert_output --partial "X-Floci-Compat"
+}
+
+@test "Terraform: SES receipt rule round-trips its actions" {
+    run aws_cmd ses describe-receipt-rule --rule-set-name floci-compat-rule-set --rule-name floci-compat-rule
+    assert_success
+    assert_output --partial "X-Floci-Compat"
+    assert_output --partial "floci-compat-events"
+    assert_output --partial "RuleSet"
+}
+
+@test "Terraform: DynamoDB table created" {
+    run aws_cmd dynamodb describe-table --table-name floci-compat-items
+    assert_success
+    assert_output --partial "ACTIVE"
+}
+
+@test "Terraform: SSM parameter created" {
+    run aws_cmd ssm get-parameter --name /floci-compat/db-url
+    assert_success
+    assert_output --partial "jdbc:"
+}
+
+@test "Terraform: Secrets Manager secret created" {
+    run aws_cmd secretsmanager describe-secret --secret-id "floci-compat/db-creds"
+    assert_success
+    assert_output --partial "floci-compat"
+}
+
+@test "Terraform: ECR repository created" {
+    run aws_cmd ecr describe-repositories --repository-names floci-compat-app
+    assert_success
+    assert_output --partial "floci-compat-app"
+}
+
+@test "Terraform: ECS cluster created" {
+    run aws_cmd ecs describe-clusters --clusters floci-compat-cluster
+    assert_success
+    assert_output --partial "floci-compat-cluster"
+    assert_output --partial "ACTIVE"
+}
+
+@test "Terraform: KMS key created" {
+    run aws_cmd kms list-keys
+    assert_success
+    [ "$(aws_cmd kms list-keys --query 'length(Keys)' --output text)" -gt 0 ]
+}
+
+@test "Terraform: Kinesis stream created" {
+    run aws_cmd kinesis describe-stream-summary --stream-name floci-compat-events
+    assert_success
+    assert_output --partial "ACTIVE"
+}
+
+@test "Terraform: CloudWatch log group created" {
+    run aws_cmd logs describe-log-groups --log-group-name-prefix /floci/compat/app
+    assert_success
+    assert_output --partial "/floci/compat/app"
+}
+
+@test "Terraform: EventBridge event bus created" {
+    run aws_cmd events describe-event-bus --name floci-compat-bus
+    assert_success
+    assert_output --partial "floci-compat-bus"
+}
+
+@test "Terraform: Step Functions state machine created" {
+    run aws_cmd stepfunctions list-state-machines
+    assert_success
+    assert_output --partial "floci-compat-state-machine"
+}
+
+@test "Terraform: CloudFormation stack created" {
+    run aws_cmd cloudformation describe-stacks --stack-name floci-compat-stack
+    assert_success
+    assert_output --partial "floci-compat-stack"
+}
+
+@test "Terraform: EKS cluster created" {
+    run aws_cmd eks describe-cluster --name floci-compat-eks
+    assert_success
+    assert_output --partial "floci-compat-eks"
+    assert_output --partial "ACTIVE"
+}
+
+@test "Terraform: API Gateway v2 HTTP API created" {
+    run aws_cmd apigatewayv2 get-apis
+    assert_success
+    assert_output --partial "floci-compat-http-api"
+}
+
+@test "Terraform: AppConfig application created" {
+    run aws_cmd appconfig list-applications
+    assert_success
+    assert_output --partial "floci-compat-appconfig"
+}
+
+@test "Terraform: Backup vault created" {
+    run aws_cmd backup describe-backup-vault --backup-vault-name floci-compat-vault
+    assert_success
+    assert_output --partial "floci-compat-vault"
+}
+
+@test "Terraform: Cloud Map namespace created" {
+    run aws_cmd servicediscovery list-namespaces
+    assert_success
+    assert_output --partial "floci-compat.internal"
+}
+
+@test "Terraform: CodeDeploy application created" {
+    run aws_cmd deploy get-application --application-name floci-compat-codedeploy
+    assert_success
+    assert_output --partial "floci-compat-codedeploy"
+}
+
+@test "Terraform: ACM certificate created" {
+    run aws_cmd acm list-certificates
+    assert_success
+    assert_output --partial "floci-compat.internal"
+}
+
+@test "Terraform: SES identity created" {
+    run aws_cmd ses get-identity-verification-attributes \
+        --identities terraform@floci-compat.internal
+    assert_success
+    assert_output --partial "terraform@floci-compat.internal"
+}
+
+@test "Terraform: EventBridge schedule created" {
+    run aws_cmd scheduler get-schedule --name floci-compat-schedule
+    assert_success
+    assert_output --partial "floci-compat-schedule"
+}
+
+@test "Terraform: WAFv2 web ACL created" {
+    run aws_cmd wafv2 list-web-acls --scope REGIONAL
+    assert_success
+    assert_output --partial "floci-compat-waf"
+}
+
+@test "Terraform: Cost and Usage Report created" {
+    run aws_cmd cur describe-report-definitions
+    assert_success
+    assert_output --partial "floci-compat-report"
+}
+
+@test "Terraform: AppSync GraphQL API created" {
+    run aws_cmd appsync list-graphql-apis
+    assert_success
+    assert_output --partial "floci-compat-graphql"
+}
+
+@test "Terraform: ElastiCache replication group created" {
+    run aws_cmd elasticache describe-replication-groups --replication-group-id floci-compat-cache
+    assert_success
+    assert_output --partial "floci-compat-cache"
+}
+
+@test "Terraform: Firehose delivery stream created" {
+    run aws_cmd firehose list-delivery-streams
+    assert_success
+    assert_output --partial "floci-compat-firehose-basic"
+}
+
+@test "Terraform: EventBridge pipe created" {
+    run aws_cmd pipes list-pipes
+    assert_success
+    assert_output --partial "floci-compat-pipe"
+}
+
+@test "Terraform: RDS DB instance created and available" {
+    run aws_cmd rds describe-db-instances --db-instance-identifier floci-compat-db
+    assert_success
+    assert_output --partial "floci-compat-db"
+    assert_output --partial "available"
+}
+
+@test "Terraform: CloudWatch alarm created with tags" {
+    run aws_cmd cloudwatch describe-alarms --alarm-names floci-compat-cpu-alarm
+    assert_success
+    assert_output --partial "floci-compat-cpu-alarm"
+
+    ALARM_ARN=$(aws_cmd cloudwatch describe-alarms --alarm-names floci-compat-cpu-alarm \
+        --query 'MetricAlarms[0].AlarmArn' --output text)
+    run aws_cmd cloudwatch list-tags-for-resource --resource-arn "$ALARM_ARN"
+    assert_success
+    assert_output --partial "compat-test"
+}
+
+@test "Terraform: VPC created with custom DNS settings" {
+    run aws_cmd ec2 describe-vpcs \
+        --filters "Name=tag:Name,Values=floci-compat-vpc"
+    assert_success
+    assert_output --partial "floci-compat-vpc"
+    assert_output --partial "10.0.0.0/16"
+}
+
+@test "Terraform: VPC enableDnsSupport persisted as false" {
+    VPC_ID=$(aws_cmd ec2 describe-vpcs \
+        --filters "Name=tag:Name,Values=floci-compat-vpc" \
+        --query 'Vpcs[0].VpcId' --output text)
+    run aws_cmd ec2 describe-vpc-attribute \
+        --vpc-id "$VPC_ID" --attribute enableDnsSupport
+    assert_success
+    assert_output --partial '"Value": false'
+}
+
+@test "Terraform: VPC enableDnsHostnames persisted as false" {
+    VPC_ID=$(aws_cmd ec2 describe-vpcs \
+        --filters "Name=tag:Name,Values=floci-compat-vpc" \
+        --query 'Vpcs[0].VpcId' --output text)
+    run aws_cmd ec2 describe-vpc-attribute \
+        --vpc-id "$VPC_ID" --attribute enableDnsHostnames
+    assert_success
+    assert_output --partial '"Value": false'
+}
+
+@test "Terraform: Route53 hosted zone created" {
+    ZONE_ID=$(aws_cmd route53 list-hosted-zones \
+        --query "HostedZones[?Name=='floci-compat.internal.'].Id | [0]" \
+        --output text | sed 's|/hostedzone/||')
+    [ -n "$ZONE_ID" ]
+    run aws_cmd route53 get-hosted-zone --id "$ZONE_ID"
+    assert_success
+    assert_output --partial "floci-compat.internal"
+}
+
+@test "Terraform: Route53 A record created" {
+    ZONE_ID=$(aws_cmd route53 list-hosted-zones \
+        --query "HostedZones[?Name=='floci-compat.internal.'].Id | [0]" \
+        --output text | sed 's|/hostedzone/||')
+    run aws_cmd route53 list-resource-record-sets --hosted-zone-id "$ZONE_ID"
+    assert_success
+    assert_output --partial "app.floci-compat.internal"
+    assert_output --partial "10.0.1.10"
+}
+
+@test "Terraform: Route53 zone has auto-created SOA and NS records" {
+    ZONE_ID=$(aws_cmd route53 list-hosted-zones \
+        --query "HostedZones[?Name=='floci-compat.internal.'].Id | [0]" \
+        --output text | sed 's|/hostedzone/||')
+    run aws_cmd route53 list-resource-record-sets --hosted-zone-id "$ZONE_ID"
+    assert_success
+    assert_output --partial '"SOA"'
+    assert_output --partial '"NS"'
+}
+
+@test "Terraform: Route53 health check created" {
+    HEALTH_CHECK_ID=$(aws_cmd route53 list-health-checks \
+        --query "HealthChecks[?HealthCheckConfig.FullyQualifiedDomainName=='app.floci-compat.internal'].Id | [0]" \
+        --output text)
+    [ -n "$HEALTH_CHECK_ID" ]
+    run aws_cmd route53 get-health-check --health-check-id "$HEALTH_CHECK_ID"
+    assert_success
+    assert_output --partial "app.floci-compat.internal"
+    assert_output --partial "HTTP"
+}
+
+@test "Terraform: Route53 zone tags persisted" {
+    ZONE_ID=$(aws_cmd route53 list-hosted-zones \
+        --query "HostedZones[?Name=='floci-compat.internal.'].Id | [0]" \
+        --output text | sed 's|/hostedzone/||')
+    run aws_cmd route53 list-tags-for-resource \
+        --resource-type hostedzone --resource-id "$ZONE_ID"
+    assert_success
+    assert_output --partial "compat-test"
+}
+
+@test "Terraform: Cognito user pool client created without optional blocks" {
+    POOL_ID=$(aws_cmd cognito-idp list-user-pools --max-results 10 \
+        --query "UserPools[?Name=='floci-compat-pool'].Id | [0]" --output text)
+    [ -n "$POOL_ID" ]
+    run aws_cmd cognito-idp list-user-pool-clients --user-pool-id "$POOL_ID" \
+        --query "UserPoolClients[?ClientName=='floci-compat-pool-client'].ClientId | [0]" --output text
+    assert_success
+    [ -n "$output" ]
+    [ "$output" != "None" ]
+}
+
+@test "Terraform: Firehose extended_s3 delivery stream created with correct config" {
+    run aws_cmd firehose describe-delivery-stream --delivery-stream-name floci-compat-firehose \
+        --query "DeliveryStreamDescription.Destinations[0].ExtendedS3DestinationDescription.CompressionFormat" --output text
+    assert_success
+    assert_output "GZIP"
+}
+
+@test "Terraform: Application Auto Scaling scalable target created with tags" {
+    run aws_cmd application-autoscaling describe-scalable-targets --service-namespace ecs \
+        --resource-ids service/floci-compat-cluster/floci-compat-service \
+        --query "ScalableTargets[0].MaxCapacity" --output text
+    assert_success
+    assert_output "20"
+
+    run aws_cmd application-autoscaling describe-scalable-targets --service-namespace ecs \
+        --resource-ids service/floci-compat-cluster/floci-compat-service \
+        --query "ScalableTargets[0].ScalableTargetARN" --output text
+    assert_success
+    [[ "$output" == arn:aws:application-autoscaling:* ]]
+
+    run aws_cmd application-autoscaling list-tags-for-resource --resource-arn "$output" \
+        --query "Tags.Environment" --output text
+    assert_success
+    assert_output "compat-test"
+}
+
+@test "Terraform: Application Auto Scaling target-tracking policy round-trips resource_label" {
+    run aws_cmd application-autoscaling describe-scaling-policies --service-namespace ecs \
+        --resource-id service/floci-compat-cluster/floci-compat-service \
+        --query "ScalingPolicies[?PolicyName=='floci-compat-alb-request-count'].TargetTrackingScalingPolicyConfiguration.PredefinedMetricSpecification.ResourceLabel | [0]" \
+        --output text
+    assert_success
+    assert_output "app/floci-compat-alb/abc123/targetgroup/floci-compat-tg/def456"
+
+    run aws_cmd application-autoscaling describe-scaling-policies --service-namespace ecs \
+        --resource-id service/floci-compat-cluster/floci-compat-service \
+        --query "ScalingPolicies[?PolicyName=='floci-compat-alb-request-count'].TargetTrackingScalingPolicyConfiguration.ScaleInCooldown | [0]" \
+        --output text
+    assert_success
+    assert_output "240"
+}
+
+# A successful apply proves very little on its own: a response that silently drops a
+# field still applies cleanly, and only shows up later as perpetual drift. Asserting an
+# empty second plan is what actually catches that class of bug.
+#
+# Whole-config: this used to be scoped to just the Application Auto Scaling resources
+# because a full re-plan reported drift on aws_cognito_user_pool (device_configuration,
+# email_configuration, user_pool_add_ons), aws_db_instance (auto_minor_version_upgrade)
+# and aws_kinesis_firehose_delivery_stream (s3_backup_mode) - see #2200. Now that those
+# are fixed, this guards every resource in the fixture instead of a hand-picked subset.
+@test "Terraform: re-planning the full configuration reports no changes" {
+    cd "$TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode
+    if [ "$status" -eq 2 ]; then
+        echo "# drift detected on re-plan:" >&3
+        echo "$output" >&3
+    fi
+    [ "$status" -eq 0 ]
+}
+
+@test "Terraform: IAM role attaches managed policies outside the curated set" {
+    run aws_cmd iam list-attached-role-policies --role-name floci-compat-managed-policy-role \
+        --query "sort_by(AttachedPolicies, &PolicyArn)[].PolicyArn" --output text
+    assert_success
+    assert_output --partial "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
+    assert_output --partial "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole"
+}
+
+# A policy AWS does not publish must still be rejected, otherwise a typo silently
+# "succeeds" and Terraform/CloudFormation never surface the mistake.
+@test "Terraform: attaching a nonexistent managed policy still fails" {
+    run aws_cmd iam attach-role-policy --role-name floci-compat-managed-policy-role \
+        --policy-arn "arn:aws:iam::aws:policy/AmazonS3FullAcess"
+    assert_failure
+    assert_output --partial "NoSuchEntity"
+}
+
+# Tags are stored and readable via ListRoleTags, but the provider reads them off the
+# GetRole response. Omitting them there made every tagged role read back untagged.
+@test "Terraform: GetRole returns the role's tags" {
+    run aws_cmd iam get-role --role-name floci-compat-tagged-role \
+        --query "Role.Tags[?Key=='Environment'].Value" --output text
+    assert_success
+    assert_output "compat"
+}
+
+@test "Terraform: GetPolicy returns the policy's tags" {
+    policy_arn=$(aws_cmd iam list-policies --scope Local \
+        --query "Policies[?PolicyName=='floci-compat-tagged-policy'].Arn" --output text)
+    run aws_cmd iam get-policy --policy-arn "$policy_arn" \
+        --query "Policy.Tags[?Key=='Environment'].Value" --output text
+    assert_success
+    assert_output "compat"
+}
+
+# The other half of the contract: IAM's listing operations deliberately return a subset
+# of attributes. ListRoles "does not return the following attributes, even though they
+# are an attribute of the returned object: PermissionsBoundary, RoleLastUsed, Tags".
+# Emitting them here would deviate from AWS in the opposite direction.
+@test "Terraform: ListRoles omits tags even for a tagged role" {
+    run aws_cmd iam list-roles \
+        --query "Roles[?RoleName=='floci-compat-tagged-role'].Tags" --output text
+    assert_success
+    refute_output --partial "compat"
+}
+
+@test "Terraform: ListPolicies omits tags and description even for a tagged policy" {
+    run aws_cmd iam list-policies --scope Local \
+        --query "Policies[?PolicyName=='floci-compat-tagged-policy'].[Tags,Description]" \
+        --output text
+    assert_success
+    refute_output --partial "compat"
+    refute_output --partial "round trip"
+}
+
+# The assertion that actually matters for the drift class: tags that do not survive the
+# round trip apply cleanly and then re-plan dirty forever.
+@test "Terraform: re-planning the tagged IAM resources reports no changes" {
+    cd "$TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode \
+        -target=aws_iam_role.tagged \
+        -target=aws_iam_policy.tagged
+    if [ "$status" -eq 2 ]; then
+        echo "# drift detected on re-plan:" >&3
+        echo "$output" >&3
+    fi
+    [ "$status" -eq 0 ]
+}
+
+@test "Terraform: GuardDuty detector is created with features" {
+    run aws_cmd guardduty list-detectors --query "DetectorIds[0]" --output text
+    assert_success
+    DETECTOR_ID="$output"
+    run aws_cmd guardduty get-detector --detector-id "$DETECTOR_ID" \
+        --query "[Status, FindingPublishingFrequency]" --output text
+    assert_success
+    assert_output --partial "ENABLED"
+    assert_output --partial "SIX_HOURS"
+}
+
+@test "Terraform: GuardDuty organization configuration round-trips" {
+    run aws_cmd guardduty list-detectors --query "DetectorIds[0]" --output text
+    assert_success
+    DETECTOR_ID="$output"
+    run aws_cmd guardduty describe-organization-configuration --detector-id "$DETECTOR_ID" \
+        --query "AutoEnableOrganizationMembers" --output text
+    assert_success
+    assert_output "ALL"
+}
+
+# additional_configuration is an ordered list block; drift here means the
+# emulator reordered the list on read-back.
+@test "Terraform: re-planning GuardDuty reports no changes" {
+    cd "$TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode \
+        -target=aws_guardduty_detector.compat \
+        -target=aws_guardduty_detector_feature.runtime_monitoring \
+        -target=aws_guardduty_organization_configuration.compat \
+        -target=aws_guardduty_organization_configuration_feature.runtime_monitoring
+    if [ "$status" -eq 2 ]; then
+        echo "# drift detected on re-plan:" >&3
+        echo "$output" >&3
+    fi
+    [ "$status" -eq 0 ]
+}
+
+@test "Terraform: Transfer Family server created and ONLINE" {
+    run aws_cmd transfer list-servers --query "Servers[0].State" --output text
+    assert_success
+    assert_output "ONLINE"
+}
+
+@test "Terraform: CloudTrail trail created, logging and tagged" {
+    run aws_cmd cloudtrail describe-trails --trail-name-list floci-compat-trail \
+        --query "trailList[0].S3BucketName" --output text
+    assert_success
+    assert_output "floci-compat-trail-logs"
+    run aws_cmd cloudtrail get-trail-status --name floci-compat-trail \
+        --query "IsLogging" --output text
+    assert_success
+    assert_output "True"
+    run aws_cmd cloudtrail describe-trails --trail-name-list floci-compat-trail \
+        --query "trailList[0].TrailARN" --output text
+    assert_success
+    TRAIL_ARN="$output"
+    run aws_cmd cloudtrail list-tags --resource-id-list "$TRAIL_ARN" \
+        --query "ResourceTagList[0].TagsList[?Key=='Environment'].Value" --output text
+    assert_success
+    assert_output "compat-test"
+}
+
+# The tag refresh path (issue #2800): a re-plan reads the trail back, including its
+# tags via ListTags, and must not report drift.
+@test "Terraform: re-planning CloudTrail reports no changes" {
+    cd "$TF_DIR"
+    run terraform plan -var="endpoint=${FLOCI_ENDPOINT}" -input=false -no-color -detailed-exitcode \
+        -target=aws_cloudtrail.compat
+    if [ "$status" -eq 2 ]; then
+        echo "# drift detected on re-plan:" >&3
+        echo "$output" >&3
+    fi
+    [ "$status" -eq 0 ]
+}

compatibility-tests/compat-terraform/test/test_helper/common-setup.bash

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Common setup for Terraform bats tests
+
+TF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+# Load bats helpers - support both local and Docker environments
+if [[ -d "${TF_DIR}/../lib/bats-support" ]]; then
+    load "${TF_DIR}/../lib/bats-support/load"
+    load "${TF_DIR}/../lib/bats-assert/load"
+elif [[ -d "${TF_DIR}/lib/bats-support" ]]; then
+    load "${TF_DIR}/lib/bats-support/load"
+    load "${TF_DIR}/lib/bats-assert/load"
+elif [[ -n "${BATS_LIB_PATH:-}" ]]; then
+    load "${BATS_LIB_PATH}/bats-support/load"
+    load "${BATS_LIB_PATH}/bats-assert/load"
+else
+    echo "Error: Cannot find bats-support/bats-assert libraries" >&2
+    exit 1
+fi
+
+# Shared test helpers kept local to this module so Docker and local runs behave the same.
+export FLOCI_ENDPOINT="${FLOCI_ENDPOINT:-http://localhost:4566}"
+export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
+export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-test}"
+export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-test}"
+export AWS_ENDPOINT_URL="$FLOCI_ENDPOINT"
+
+aws_cmd() {
+    aws --endpoint-url "$FLOCI_ENDPOINT" --region "$AWS_DEFAULT_REGION" --output json "$@"
+}
+
+json_get() {
+    local json="$1"
+    local path="$2"
+    echo "$json" | jq -r "$path" 2>/dev/null || echo ""
+}
+
+# Terraform-specific helpers
+create_state_backend() {
+    # Create S3 state bucket if not exists
+    if ! aws_cmd s3api head-bucket --bucket tfstate 2>/dev/null; then
+        aws_cmd s3api create-bucket --bucket tfstate
+    fi
+
+    # Create DynamoDB lock table if not exists
+    if ! aws_cmd dynamodb describe-table --table-name tflock 2>/dev/null | grep -q ACTIVE; then
+        aws_cmd dynamodb create-table \
+            --table-name tflock \
+            --attribute-definitions AttributeName=LockID,AttributeType=S \
+            --key-schema AttributeName=LockID,KeyType=HASH \
+            --billing-mode PAY_PER_REQUEST
+    fi
+}
+
+generate_backend_config() {
+    cat > /tmp/floci-backend.hcl <<EOF
+bucket = "tfstate"
+key    = "floci-compat.tfstate"
+region = "us-east-1"
+
+endpoint                    = "${FLOCI_ENDPOINT}"
+access_key                  = "test"
+secret_key                  = "test"
+skip_credentials_validation = true
+skip_region_validation      = true
+use_path_style              = true
+
+dynamodb_endpoint = "${FLOCI_ENDPOINT}"
+dynamodb_table    = "tflock"
+EOF
+}