How we verify

What a gotcha is

A verifiable fact about a cloud, its practical consequence and what to do about it. It is not an opinion or a ranking: if something is simpler or cheaper on one cloud, the text says what you pay for elsewhere.

Accepted sources

Every gotcha needs at least one official documentation source. The build fails if a source is outside these domains:

• learn.microsoft.com
• azure.microsoft.com
• docs.aws.amazon.com
• aws.amazon.com
• repost.aws
• cloud.google.com
• docs.cloud.google.com
• registry.terraform.io
• developer.hashicorp.com
• docs.github.com

Blogs, forums and videos help discover a problem, not back it up.

Freshness

Every gotcha carries the date someone read its sources and confirmed the text (verified_at). After 180 days it's marked "re-verify" and a weekly workflow keeps an issue with the list. Re-verifying a gotcha is the most valuable contribution to the project.

What the site guarantees and what it does not

Automated checks guarantee that every gotcha has an official source, a date, and that the Terraform compiles. They do not guarantee that what the gotcha says is true: a person confirms that by reading the source. Today the maintainer verifies the gotchas; those without an external reviewer say so on their card ("no external reviewer"). When someone with experience in that cloud reviews them, the card shows their GitHub handle.

If you find a mistake, use "Report outdated" on the card. If you want to review a cloud, see CONTRIBUTING.

What every PR is checked for

terraform fmt -check

Canonical formatting.

terraform validate

Against the pinned provider’s real schema (catches attributes renamed across versions).

terraform test

With mock_provider: assertions on what the pattern promises, without credentials or real resources.

tflint

Per-cloud ruleset (SKUs, regions, arguments).

checkov

Zero failures. Every exception lives in the code with its reason and shows in the published snippet.

lychee

Every official source still responds.

Limitation: tests with mock providers don’t catch errors that only show up when applying against the real API (quotas, taken names, regional availability). Use the modules as a reviewed starting point, not as a certified deployment.