I can't tell if this should have a /s on it but terraform does have this feature (local-exec, remote-exec) and you don't need Terraform Enterprise, the free one does just fine.

You can also write your own providers etc etc. The whole reason hooks are needed is because you don't have direct access to the execution engine.

If you really want access to the execution engine, looks like one team found a way. https://orca.security/resources/blog/aws-cloudformation-vuln...