[substation13]

With Terraform you can statically analyze the infrastructure definition with some guarantees of determinism etc. Arbitrary execution is allowed, as you say, but only in well-contained places, such as local_exec.

How can this work if, say, TypeScript is used as the definition language?

[jen20]

What degree of determinism do you actually have if provisioners can execute Turing complete code?

[substation13]

It's a bit like how Rust limits dangerous operations to unsafe blocks