I deeply believe that the whole "state" approach with TF is flawed. You end up doing a 3-way merge between the actual state, the desired state, and the recorded state every time you try to make changes.

Long time ago, I was simply doing stuff like this:

> resources = describe_resources_by_tag(env_name=env, some_tag=tag) > if resource_doesnt_exist(resources, some_resource): > create_resource(resource)

This was very robust and easy to explain. You look around the system, using some tag-based filtering (in AWS, GCP, Azure) and then perform actions to bring the system to the desired state.

The proper way to solve this would be to have a cloud provider (possibly based on AWS or Azure) whose UI simply edits an auto-generated IaaC script. That way ALL changes go through the code. And if there's a need to do a 3-way merge, it's obvious, because you're having to do a 3-way merge in git.