Hmm, not sure how I am conflating things, I meant to just wrote about ARM templates full stop? The API I refer to is the Azure Management API (we ended up using

Hmm, not sure how I am conflating things, I meant to just wrote about ARM templates full stop? The API I refer to is the Azure Management API (we ended up using that directly from Python instead of using ARM ourselves)... I said that referencing by name is one of the few things that are good about Azure. It means one does not have to persist a lot of resource IDs when deploying infra, one can just query the cloud state. What I am looking for -- or what I would love if someone built for me -- is utilizing that feature to deliver Terraform or Pulumi without the need for a statefile. The statefile should not be needed on Azure due to the resource naming scheme -- just query the management APIs to get currrent state. When we looked at Terraform and Pulumi we saw that the tools by default sucked down evey secret in the resources into the statefile. This is behaviour I very much disagree with, we do not want secrets stored anywhere or pass through anywhere, we want to rely on service identity everywhere. PS I am speculating here about why the statefile is needed...I have been assuming something about Amazon made it needed, but I may be wrong.