We avoid it entirely. If it can't be done in Terraform, it must be done outside Terraform and fed in via variables. Though of course there's also teams that ru

We avoid it entirely. If it can't be done in Terraform, it must be done outside Terraform and fed in via variables. Though of course there's also teams that run ansible from it with lots of implicit settings, making it a pain to move from dev machines to CI.