> Besides, one repository holding all the IaC stuff? That just sounds like hour long `terraform refresh` sessions.

If it is terraform, then typically it's split up into multiple "root modules" which get planned and applied separately, even though it's all in one repo.