The proper way to solve this would be to have a cloud provider (possibly based on AWS or Azure) whose UI simply edits an auto-generated IaaC script. That way ALL changes go through the code. And if there's a need to do a 3-way merge, it's obvious, because you're having to do a 3-way merge in git.