diff --git a/docs/containers/ecr/README.md b/docs/containers/ecr/README.md
index 5eb77b2dc..e5798f537 100644
--- a/docs/containers/ecr/README.md
+++ b/docs/containers/ecr/README.md
@@ -146,12 +146,11 @@ Repositories can be managed as code with the standard `aws_ecr_repository` resou
 
 ```hcl
 provider "aws" {
-  region                      = "ap-southeast-2"
-  skip_credentials_validation = true
-  skip_requesting_account_id  = true
+  region = "ap-southeast-2"
 
   endpoints {
     ecr = "https://<your-spinifex-gateway>"
+    sts = "https://<your-spinifex-gateway>"
   }
 }
 
diff --git a/docs/migration/moving-aws-workload/README.md b/docs/migration/moving-aws-workload/README.md
index 7d3f1f581..7009de4af 100644
--- a/docs/migration/moving-aws-workload/README.md
+++ b/docs/migration/moving-aws-workload/README.md
@@ -74,10 +74,8 @@ provider "aws" {
     s3                 = "https://localhost:8443"
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 ```
 
@@ -91,16 +89,16 @@ aws s3 sync s3://local-bucket/ s3://cloud-bucket/ --source-region spinifex --reg
 
 ## Terraform Provider Errors
 
-Ensure all four skip flags are set in your provider configuration:
+Ensure these two skip flags are set in your provider configuration:
 
 ```hcl
-skip_credentials_validation = true
-skip_metadata_api_check     = true
-skip_requesting_account_id  = true
-skip_region_validation      = true
+skip_metadata_api_check = true
+skip_region_validation  = true
 ```
 
-Without these, Terraform will try to validate credentials and metadata against real AWS endpoints.
+Without them, Terraform queries the EC2 instance metadata service for credentials and rejects a region name AWS does not know.
+
+Leave `skip_credentials_validation` and `skip_requesting_account_id` unset, and point the `sts` endpoint at Spinifex. The provider then learns the account ID from `GetCallerIdentity` as it does on AWS. With the account ID blank, a security group rule that references a group in the same account reads back as `<account>/sg-...` and never reaches a clean plan.
 
 ## S3 Signature Errors
 
diff --git a/docs/terraform-workbooks/bastion-private-subnet/main.tf b/docs/terraform-workbooks/bastion-private-subnet/main.tf
index 3afcf0d47..75dcf3bcf 100644
--- a/docs/terraform-workbooks/bastion-private-subnet/main.tf
+++ b/docs/terraform-workbooks/bastion-private-subnet/main.tf
@@ -76,10 +76,8 @@ provider "aws" {
     sts = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------
diff --git a/docs/terraform-workbooks/ecs-quickstart/main.tf b/docs/terraform-workbooks/ecs-quickstart/main.tf
index c931d8996..38036770d 100644
--- a/docs/terraform-workbooks/ecs-quickstart/main.tf
+++ b/docs/terraform-workbooks/ecs-quickstart/main.tf
@@ -114,10 +114,8 @@ provider "aws" {
     elasticloadbalancingv2 = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------
diff --git a/docs/terraform-workbooks/eks-gitops-argocd/main.tf b/docs/terraform-workbooks/eks-gitops-argocd/main.tf
index 8dd32c9b7..a89e10abe 100644
--- a/docs/terraform-workbooks/eks-gitops-argocd/main.tf
+++ b/docs/terraform-workbooks/eks-gitops-argocd/main.tf
@@ -118,10 +118,8 @@ provider "aws" {
     acm = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 data "aws_availability_zones" "available" {
diff --git a/docs/terraform-workbooks/eks-gitops-argocd/workloads/main.tf b/docs/terraform-workbooks/eks-gitops-argocd/workloads/main.tf
index f16665422..859db793a 100644
--- a/docs/terraform-workbooks/eks-gitops-argocd/workloads/main.tf
+++ b/docs/terraform-workbooks/eks-gitops-argocd/workloads/main.tf
@@ -80,10 +80,8 @@ provider "aws" {
     eks = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 data "terraform_remote_state" "infra" {
diff --git a/docs/terraform-workbooks/eks-https-ingress/main.tf b/docs/terraform-workbooks/eks-https-ingress/main.tf
index 146e7a70e..f7b8ba53b 100644
--- a/docs/terraform-workbooks/eks-https-ingress/main.tf
+++ b/docs/terraform-workbooks/eks-https-ingress/main.tf
@@ -115,10 +115,8 @@ provider "aws" {
     acm = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 data "aws_availability_zones" "available" {
diff --git a/docs/terraform-workbooks/eks-https-ingress/workloads/main.tf b/docs/terraform-workbooks/eks-https-ingress/workloads/main.tf
index b22f65e43..4ea56a2fb 100644
--- a/docs/terraform-workbooks/eks-https-ingress/workloads/main.tf
+++ b/docs/terraform-workbooks/eks-https-ingress/workloads/main.tf
@@ -63,10 +63,8 @@ provider "aws" {
     eks = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # Cluster identity comes from the parent module's state; the live endpoint/CA
diff --git a/docs/terraform-workbooks/eks-quickstart/main.tf b/docs/terraform-workbooks/eks-quickstart/main.tf
index 5b3ad53d0..1f42779e5 100644
--- a/docs/terraform-workbooks/eks-quickstart/main.tf
+++ b/docs/terraform-workbooks/eks-quickstart/main.tf
@@ -103,10 +103,8 @@ provider "aws" {
     ecr = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------
diff --git a/docs/terraform-workbooks/eks-quickstart/workloads/main.tf b/docs/terraform-workbooks/eks-quickstart/workloads/main.tf
index ac90ebd95..ab7b43819 100644
--- a/docs/terraform-workbooks/eks-quickstart/workloads/main.tf
+++ b/docs/terraform-workbooks/eks-quickstart/workloads/main.tf
@@ -54,10 +54,8 @@ provider "aws" {
     eks = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # Cluster identity comes from the parent module's state; the live endpoint/CA
diff --git a/docs/terraform-workbooks/nginx-alb/main.tf b/docs/terraform-workbooks/nginx-alb/main.tf
index 0064c1a2e..81a6c0985 100644
--- a/docs/terraform-workbooks/nginx-alb/main.tf
+++ b/docs/terraform-workbooks/nginx-alb/main.tf
@@ -58,7 +58,7 @@ variable "region" {
 }
 
 variable "instance_type" {
-  type = string
+  type    = string
   default = "t3.small"
 }
 
@@ -82,10 +82,8 @@ provider "aws" {
     elasticloadbalancingv2 = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------
diff --git a/docs/terraform-workbooks/nginx-webserver/main.tf b/docs/terraform-workbooks/nginx-webserver/main.tf
index d1cb3e6b6..5352ee7ee 100644
--- a/docs/terraform-workbooks/nginx-webserver/main.tf
+++ b/docs/terraform-workbooks/nginx-webserver/main.tf
@@ -65,10 +65,8 @@ provider "aws" {
     sts = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------
diff --git a/docs/terraform-workbooks/rds-quickstart/main.tf b/docs/terraform-workbooks/rds-quickstart/main.tf
index 1d55c7b9c..5b3bf8587 100644
--- a/docs/terraform-workbooks/rds-quickstart/main.tf
+++ b/docs/terraform-workbooks/rds-quickstart/main.tf
@@ -135,10 +135,8 @@ provider "aws" {
     rds = var.spinifex_endpoint
   }
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------
diff --git a/docs/terraform-workbooks/s3-webapp/main.tf b/docs/terraform-workbooks/s3-webapp/main.tf
index 95309f733..34f3f0a76 100644
--- a/docs/terraform-workbooks/s3-webapp/main.tf
+++ b/docs/terraform-workbooks/s3-webapp/main.tf
@@ -124,10 +124,8 @@ provider "aws" {
 
   s3_use_path_style = true
 
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-  skip_region_validation      = true
+  skip_metadata_api_check = true
+  skip_region_validation  = true
 }
 
 # ---------------------------------------------------------------------------