The one that comes to mind is changing the security group for lambdas from an auto generated one (unspecified in terraform) to a specified one. It had some kind of chicken/egg situation so I ended up having to run two change sets - one to have both security groups set then another to remove the extra. Had to do the same thing in cdk and it just worked. There have been other similar things where everything is fine until you hit some edge case and then you’re just wasting time and money doing acrobatics to work around the quirks (that don’t exist in cdk).

I’m not in the devops group and they’re attached to TF for some reason so I don’t get a say in what we use, but I am the “everything is busted call in anyone that can help” guy so I end up dealing with the problems lol