It's really painful but TBH there's nothing I've come across that's much better. AWS' own tools for managing this are abysmally complicated or lack versioning,

It's really painful but TBH there's nothing I've come across that's much better. AWS' own tools for managing this are abysmally complicated or lack versioning, etc. We use a git repo to manage our terraform configs and it does the job, albeit in a convoluted fashion.