docs: stop skipping the account ID lookup in Terraform provider blocks (#1101)

docs/containers/ecr/README.md

@@ -146,12 +146,11 @@ Repositories can be managed as code with the standard `aws_ecr_repository` resou
 
 ```hcl
 provider "aws" {
-  region                      = "ap-southeast-2"
-  skip_credentials_validation = true
-  skip_requesting_account_id  = true
+  region = "ap-southeast-2"
 
   endpoints {
     ecr = "https://<your-spinifex-gateway>"
+    sts = "https://<your-spinifex-gateway>"
   }
 }
 

docs/migration/moving-aws-workload/README.md

@@ -74,10 +74,8 @@ provider "aws" {
     s3                 = "https://localhost:8443"
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 ```
 
@@ -91,16 +89,16 @@ aws s3 sync s3://local-bucket/ s3://cloud-bucket/ --source-region spinifex --reg
 
 ## Terraform Provider Errors
 
-Ensure all four skip flags are set in your provider configuration:
+Ensure these two skip flags are set in your provider configuration:
 
 ```hcl
-skip_credentials_validation = true
-skip_metadata_api_check     = true
-skip_requesting_account_id  = true
-skip_region_validation      = true
+skip_metadata_api_check = true
+skip_region_validation  = true
 ```
 
-Without these, Terraform will try to validate credentials and metadata against real AWS endpoints.
+Without them, Terraform queries the EC2 instance metadata service for credentials and rejects a region name AWS does not know.
+
+Leave `skip_credentials_validation` and `skip_requesting_account_id` unset, and point the `sts` endpoint at Spinifex. The provider then learns the account ID from `GetCallerIdentity` as it does on AWS. With the account ID blank, a security group rule that references a group in the same account reads back as `<account>/sg-...` and never reaches a clean plan.
 
 ## S3 Signature Errors
 

docs/terraform-workbooks/bastion-private-subnet/main.tf

@@ -76,10 +76,8 @@ provider "aws" {
     sts = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------

docs/terraform-workbooks/ecs-quickstart/main.tf

@@ -114,10 +114,8 @@ provider "aws" {
     elasticloadbalancingv2 = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------

docs/terraform-workbooks/eks-gitops-argocd/main.tf

@@ -118,10 +118,8 @@ provider "aws" {
     acm = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 data "aws_availability_zones" "available" {

docs/terraform-workbooks/eks-gitops-argocd/workloads/main.tf

@@ -80,10 +80,8 @@ provider "aws" {
     eks = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 data "terraform_remote_state" "infra" {

docs/terraform-workbooks/eks-https-ingress/main.tf

@@ -115,10 +115,8 @@ provider "aws" {
     acm = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 data "aws_availability_zones" "available" {

docs/terraform-workbooks/eks-https-ingress/workloads/main.tf

@@ -63,10 +63,8 @@ provider "aws" {
     eks = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # Cluster identity comes from the parent module's state; the live endpoint/CA

docs/terraform-workbooks/eks-quickstart/main.tf

@@ -103,10 +103,8 @@ provider "aws" {
     ecr = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------

docs/terraform-workbooks/eks-quickstart/workloads/main.tf

@@ -54,10 +54,8 @@ provider "aws" {
     eks = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # Cluster identity comes from the parent module's state; the live endpoint/CA

docs/terraform-workbooks/nginx-alb/main.tf

@@ -58,7 +58,7 @@ variable "region" {
 }
 
 variable "instance_type" {
-  type = string
+  type    = string
   default = "t3.small"
 }
 
@@ -82,10 +82,8 @@ provider "aws" {
     elasticloadbalancingv2 = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------

docs/terraform-workbooks/nginx-webserver/main.tf

@@ -65,10 +65,8 @@ provider "aws" {
     sts = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------

docs/terraform-workbooks/rds-quickstart/main.tf

@@ -135,10 +135,8 @@ provider "aws" {
     rds = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------

docs/terraform-workbooks/s3-webapp/main.tf

@@ -124,10 +124,8 @@ provider "aws" {
 
   s3_use_path_style = true
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------