[koolba]

You can have that indirection itself in a data element that does the lookup of the image and returns the digest: https://registry.terraform.io/providers/hashicorp/aws/latest...

So the data element would lookup the tag, and the specific hash is used in the deployment. No funky replace triggers needed.