You just described in a concise way why I feel like “simple non DRY terraform configuration” is much better than “insane variable indirection to avoid like 20 lines of copy pasted code”
Configs are configs. It’s better for them to be obvious and verbose than it is for them to be hard to understand and pithy. They don’t have the same requirements as the software that actually goes out on the release train.
The problem, which I've run into with terraform code like this, is when you need to change something in those 20 lines, and forget about one of the places you pasted, then spend hours trying to figure out why one system is behaving differently than the others (especially if the person debugging is different than the person who made the change).
Indeed, environment drift is definitely a problem with the aforementioned approach. There is some middle ground that enables code and variable reuse, but isn't some byzantine state machine that requires reciting magical incantations to work. Getting that middle balance is kind of tough. I think judicious use of tfvars and modules and workspace tagging can get you a long way without opening the pandoras box that is workspace orchestration.
Configs are configs. It’s better for them to be obvious and verbose than it is for them to be hard to understand and pithy. They don’t have the same requirements as the software that actually goes out on the release train.