The point about a data source returning a new latest AMI quietly triggering a replacement really stood out — that is the kind of surprise that does not show up in the change you actually made. I also liked the distinction between using ignore_changes for something another system legitimately manages versus using it to silence a plan you do not understand. Do you have a rule of thumb for when a replacement on a stateful resource is worth handling with a migration plan instead of accepting the recreate and scheduling downtime?