second first commit

compatibility-tests/compat-terraform/test/security-group-rule-sources-tf/provider.tf

@@ -0,0 +1,35 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  s3_use_path_style           = true
+
+  # Deliberately NOT skip_requesting_account_id. The provider renders a same-account
+  # referenced_security_group_id as a bare group id and a cross-account one as
+  # "<account>/<group>", and it tells them apart by comparing ReferencedGroupInfo.UserId
+  # against its own resolved account. Skipping account resolution leaves that unknown,
+  # so every same-account reference reads back as cross-account and the plan never
+  # converges. Floci answers STS GetCallerIdentity, so there is nothing to skip.
+
+  endpoints {
+    ec2 = var.endpoint
+    sts = var.endpoint
+  }
+}