There is a slight difference to me as having another service run (the API) is an additional attack vector to worry about from a security perspective. I would a

There is a slight difference to me as having another service run (the API) is an additional attack vector to worry about from a security perspective. I would also say it's easier to enforce good "IaC hygiene" when the configs are managed via configuration files. They can go through a code review process, deployed via existing config management systems etc.