Terraform deployments - misconfiguration?

Hi there

I'm trying to do a deployment via terraform, and this works for the first pass. But any subsequent `plan` throws a spanner in the works

For example, on a second `plan` after a successful `apply` and deployment (i see in the logs things are working fine)

```diff
# aws_serverlessapplicationrepository_cloudformation_stack.sso_sync will be updated in-place
~ resource "aws_serverlessapplicationrepository_cloudformation_stack" "sso_sync" {
id = "arn:aws:cloudformation:eu-west-2:765624835580:stack/serverlessrepo-ssosync-application/72dbff00-a38a-11f0-81e3-0a87db22ea11"
name = "ssosync-application"
~ parameters = {
+ "DryRun" = "live"
+ "FunctionName" = null
+ "GoogleGroupMatch" = "*"
+ "GoogleUserMatch" = null
+ "IgnoreGroups" = null
+ "IgnoreUsers" = null
+ "IncludeGroups" = null
+ "LogFormat" = "json"
+ "LogLevel" = "warn"
+ "MemorySize" = "128"
+ "ScheduleExpression" = "rate(15 minutes)"
+ "SyncMethod" = "groups"
+ "SyncSuspended" = "ignore"
+ "TimeOut" = "300"
# (7 unchanged elements hidden)
}
tags = {}
~ tags_all = {
+ "project" = "services/admin"
# (2 unchanged elements hidden)
}
# (5 unchanged attributes hidden)
}
```

With the following terraform:

```hcl

# other secret resources managed above this fold...

# Fetch SSOSync application metadata from AWS Serverless Application Repository
data "aws_serverlessapplicationrepository_application" "sso_sync" {
application_id = "arn:aws:serverlessrepo:us-east-2:004480582608:applications/SSOSync"
semantic_version = local.ssosync_version
}

resource "aws_serverlessapplicationrepository_cloudformation_stack" "sso_sync" {
name = local.stack_name
application_id = data.aws_serverlessapplicationrepository_application.sso_sync.application_id
semantic_version = data.aws_serverlessapplicationrepository_application.sso_sync.semantic_version
capabilities = data.aws_serverlessapplicationrepository_application.sso_sync.required_capabilities

parameters = {
DeployPattern = "App only"

# Index 0 → GOOGLE_CREDENTIALS
# Index 1 → GOOGLE_ADMIN
# Index 2 → SCIM_ENDPOINT
# Index 3 → SCIM_ACCESS_TOKEN
# Index 4 → REGION
# Index 5 → IDENTITY_STORE_ID
CrossStackConfig = join(",", [
aws_secretsmanager_secret.google_credentials.arn,
aws_secretsmanager_secret.google_admin_email.arn,
aws_secretsmanager_secret.scim_endpoint_url.arn,
aws_secretsmanager_secret.scim_access_token.arn,
aws_secretsmanager_secret.region.arn,
aws_secretsmanager_secret.identity_store_id.arn
])

# Configuration parameters
SyncMethod = local.sync_method
GoogleGroupMatch = local.google_group_match
GoogleUserMatch = local.google_user_match
IncludeGroups = local.include_groups
IgnoreGroups = ""
IgnoreUsers = ""
DryRun = local.dry_run
PrecacheOrgUnits = local.precache_org_units
SyncSuspended = "ignore"
ScheduleExpression = local.schedule_expression
TimeOut = tostring(local.timeout)
MemorySize = tostring(local.memory_size)
LogLevel = "warn"
LogFormat = "json"
FunctionName = ""
}

depends_on = [
aws_secretsmanager_secret.google_credentials,
aws_secretsmanager_secret.google_admin_email,
aws_secretsmanager_secret.scim_endpoint_url,
aws_secretsmanager_secret.scim_access_token,
aws_secretsmanager_secret.identity_store_id,
]
}
```

No repository file, test, or entry point is named. Reproduce the second `terraform plan` after `apply` with the supplied configuration, then inspect the AWS Serverless Application Repository CloudFormation stack resource and its parameter handling. Done means a subsequent plan no longer proposes the unexpected parameter and tag changes.

Written by the indexing model from the issue text.