[charlotte-fyi]

This is solved in tools like Pulumi by having a declarative and auditable build artifact as an intermediate step that can be diffed. This seems to solve a lot of the security issues (and is generally a good idea anyway).

[NegativeLatency]

I would still prefer to debug terraform (which is a fair bit more declarative) rather than pulumi