You can have that indirection itself in a data element that does the lookup of the image and returns the digest: https://registry.terraform.io/providers/hashico

You can have that indirection itself in a data element that does the lookup of the image and returns the digest: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_image https://registry.terraform.io/providers/hashicorp/aws/latest... So the data element would lookup the tag, and the specific hash is used in the deployment. No funky replace triggers needed.