A huge issue with the statefile IMO is storing secrets and API keys. We try to make sure EVERYTHING is done through service identities (Azure). No secrets in d

A huge issue with the statefile IMO is storing secrets and API keys. We try to make sure EVERYTHING is done through service identities (Azure). No secrets in deploy scripts or resources. Terraform will happily generate and store passwords and API keys for resources even if we don't want to use them and save the keys to everything in a file on a "random" disk and suddenly we need to lock this file down. With a statefile we have to worry that secrets gets accidentally stored -- I am sure it id possible to configure it away case for case, but that is a more fragile approach. With tools without a statefile the whole problem just goes away. For us this was enough reason to disqualify Terraform.