The terraform aws_cloudformation_stack resource is capable to use a template_url
as input. That's fine,
if you like to apply some vendor CloudFormation stack, e.g. Prismacloud Read Only Role (https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/onboard-your-aws-account/update-an-onboarded-aws-account.html)
Since the URL, in the Prismacloud example https://s3.amazonaws.com/redlock-public/cft/rl-read-only.template, is a static URL Terraform wouldn't see any changes here and you would end up with never applied updates of the template hosted on S3. Unfortunately the aws_cloudformation_stack resource has no logic to "reapply/reload" the CF stack in some reoccuring interval. 😞
AWS S3 allows you to append a query string to an S3 URL. Normally this is used to generate presigned URLs for authorized up- or downloads. 💡