What
#1032's foreign-load measurement (units 3 and 4, merged) held a 79-resource estate still and applied a 3,705-resource terralith beside it under a different tofu-estate marker. The Cloud Control account-wide list stayed at 435 calls in every row and the read pass stayed at 148, so the two legs the O(types) claim rests on hold. One term grew:
| Foreign resources |
choudoufu plan calls |
| 0 |
187 |
| 79 |
197 |
| 3,705 |
687 |
Every call of that growth is GetPolicyVersion. The run says why in its own log: listing aws_iam_policy unfiltered (the list configuration for aws_iam_policy has no filter argument), and the same for aws_iam_role and aws_ecs_service. The provider's list resource for those types offers no filter block, so the sweep lists the whole account's policies and the provider reads each one's default version. This is #622's per-object refinement, which claim 20 previously cited as firing zero times on a real account that happened to hold no comparable policy population.
It is also, very likely, #1037: the native sweep leg measured 512, 552 and 612 at 79, 301 and 745 owned instances, and the terralith carries IAM policies in proportion to its scale.
Why it matters
This is a provider-schema fact, not a choudoufu one, but it is the entire measured account-tracking cost. On an account with many IAM policies that this estate does not own, every plan pays one read per policy.
Do
Decide, and it is a design call: narrow client-side (the Tagging API already answers tofu-estate server-side for taggable types, and IAM policies are taggable, so the unfiltered list may be avoidable for the owned set and needed only for the adoptable scan), or raise it upstream as a provider list-resource filter, or document it as the cost of adoption discovery on IAM-heavy accounts. Whichever, the measured row belongs on what-you-pay.md.
Also from the same unit, worth a line in the smoke README: TF_LOG's per-action histogram is a sample, not a count. hclog truncates long lines and randomises field order, so rpc.method survives on about half of HTTP Request Sent lines. Totals are exact; live/smoke/lib.sh's "top operations" table is built from that sample.
Proof
The foreign-load scenario's growth column flat, or the cost stated on the page with its cause.
Refs #1032, #1037, #622, #961.
What
#1032's foreign-load measurement (units 3 and 4, merged) held a 79-resource estate still and applied a 3,705-resource terralith beside it under a different
tofu-estatemarker. The Cloud Control account-wide list stayed at 435 calls in every row and the read pass stayed at 148, so the two legs the O(types) claim rests on hold. One term grew:choudoufu plancallsEvery call of that growth is
GetPolicyVersion. The run says why in its own log:listing aws_iam_policy unfiltered (the list configuration for aws_iam_policy has no filter argument), and the same foraws_iam_roleandaws_ecs_service. The provider's list resource for those types offers no filter block, so the sweep lists the whole account's policies and the provider reads each one's default version. This is #622's per-object refinement, which claim 20 previously cited as firing zero times on a real account that happened to hold no comparable policy population.It is also, very likely, #1037: the native sweep leg measured 512, 552 and 612 at 79, 301 and 745 owned instances, and the terralith carries IAM policies in proportion to its scale.
Why it matters
This is a provider-schema fact, not a choudoufu one, but it is the entire measured account-tracking cost. On an account with many IAM policies that this estate does not own, every plan pays one read per policy.
Do
Decide, and it is a design call: narrow client-side (the Tagging API already answers
tofu-estateserver-side for taggable types, and IAM policies are taggable, so the unfiltered list may be avoidable for the owned set and needed only for the adoptable scan), or raise it upstream as a provider list-resource filter, or document it as the cost of adoption discovery on IAM-heavy accounts. Whichever, the measured row belongs onwhat-you-pay.md.Also from the same unit, worth a line in the smoke README: TF_LOG's per-action histogram is a sample, not a count. hclog truncates long lines and randomises field order, so
rpc.methodsurvives on about half ofHTTP Request Sentlines. Totals are exact;live/smoke/lib.sh's "top operations" table is built from that sample.Proof
The foreign-load scenario's growth column flat, or the cost stated on the page with its cause.
Refs #1032, #1037, #622, #961.