Hacker News Reader

Comment by t34543 | Hacker News Reader

If you create resources outside of terraform/CF your doing it wrong. This is a feature, not a bug.

That's a beautiful statement of purity, but my reality has been different. Even with the best of intensions sometimes resources are created outside of an IaC solution and you want to bring them in.

On the other hand I hear that CF's rollback is better at not leaving things in a busted state.

This. It takes years to learn good architecture, and Cloudformation nudges you to make it right. Thats why you need senior infrastructure engineers.

This is 100% unrelated to “senior infrastructure engineers” (most of whom I’ve seen end up building pure crap), and import is simply a matter of practicality.

If we followed the (patently poor) advice above, CF users would not have been able to use NAT Gateways - to take one of several prominent examples - for many months following their launch. Terraform was substantially faster to support them, but being able to import resources created outside the normal mechanism for _any_ reason is an essential part of any IaC tool.

> If you create resources outside of terraform/CF your doing it wrong.

But at least you're doing it!

There are sometimes holes in Terraform coverage.

We don't seem to have used Terraform for everything since day one. Even if we had, we can't migrate to CloudFormation without abandoning our Terraform-created datastores and live-migrating to new ones. (Not that we necessarily want to, at this point.)

Always Outnumbered, Never Outgunned. Respect, man.

Reply on news.ycombinator.com