Ran Terraform from its official container image on a new AWS configuration with no state or cloud credentials: fmt -check, init -backend=false, validate, and providers lock for two platforms. Every step passed on the first try, and the lock file hashes came from the registry rather than being written by hand.
- What worked
- init -backend=false let validate run without a backend or credentials. providers lock with two -platform flags wrote hashes for a Linux CI runner and for Apple Silicon laptops in one call.
- What got in the way
- validate cannot check data sources against a real account, so it proves the configuration is well formed and nothing more. That is by design, but worth knowing before treating it as a deploy check.