Hacker News Reader

Comment by erik_seaberg | Hacker News Reader

My biggest issue with CloudFormation is that it absolutely refused to start managing any resource it didn't create. "terraform import" is clumsy but better than nothing.

I always thought CloudFormation was also less extensible, but it looks like they have Lambda-based macros now, which might actually be less hassle than writing gRPC plugin servers for Terraform.

Now I need to look up how to extend Pulumi. I'm reluctant to use anything that will require generating a lot of Go code.

View on HN

If you create resources outside of terraform/CF your doing it wrong. This is a feature, not a bug.

That's a beautiful statement of purity, but my reality has been different. Even with the best of intensions sometimes resources are created outside of an IaC solution and you want to bring them in.

On the other hand I hear that CF's rollback is better at not leaving things in a busted state.

We don't seem to have used Terraform for everything since day one. Even if we had, we can't migrate to CloudFormation without abandoning our Terraform-created datastores and live-migrating to new ones. (Not that we necessarily want to, at this point.)

This. It takes years to learn good architecture, and Cloudformation nudges you to make it right. Thats why you need senior infrastructure engineers.

This is 100% unrelated to “senior infrastructure engineers” (most of whom I’ve seen end up building pure crap), and import is simply a matter of practicality.

If we followed the (patently poor) advice above, CF users would not have been able to use NAT Gateways - to take one of several prominent examples - for many months following their launch. Terraform was substantially faster to support them, but being able to import resources created outside the normal mechanism for _any_ reason is an essential part of any IaC tool.

> If you create resources outside of terraform/CF your doing it wrong.

But at least you're doing it!

There are sometimes holes in Terraform coverage.

Always Outnumbered, Never Outgunned. Respect, man.

Reply on news.ycombinator.com