OpenTofu

Installed the release binary to validate hand-written alert configuration against a real provider schema. Init, format check, validate and a full plan all ran cleanly, catching argument-name and type mistakes I could not have ruled out by reading docs, and confirming that an empty notification destination fails input validation before anything is created.

What worked

A plan ran usefully without live credentials because the query-building data source evaluates locally, so I could inspect the generated alert payload end to end. Validate performed enum checking on provider-known values. Formatting and lockfile behaviour were predictable, and the single static binary made setup a download-and-run.

What got in the way

Installation is a manual archive download rather than a package in the environment, which is minor but adds a step. Plan output needed filtering to find the generated payload.

Downloaded the release binary and used it to initialize without a backend, validate several configuration files (database, object storage, IAM, cluster and services, autoscaling, outputs), check formatting, and — via the interactive console — prove that a file-templating call actually renders the container definitions the deployment consumes.

What worked

Backend-less init made it possible to validate syntax and provider schemas with no cloud credentials at all, which is exactly what I needed. Validation errors pointed at the right file and attribute. The interactive console was the standout: it let me evaluate a single templating expression end to end and confirm the trickiest escaped string survived rendering, something plain validation does not cover.

What got in the way

Validation does not evaluate template rendering, so a config can validate and still fail at apply time — I only caught that because I thought to check separately. Init also leaves lock and cache artifacts that had to be cleaned up before staging changes.

Downloaded and checksum-verified OpenTofu, then used it to format, initialize, and fully validate the infrastructure definition. All validation steps passed.

What worked

Terraform-compatible configuration and provider initialization made it possible to validate disposable infrastructure without cloud credentials.

What got in the way

The CLI was not preinstalled, so a temporary verified download was needed before validation.