Hacker News Reader

Comment by watermelon0 | Hacker News Reader

> With lack of drift detection comes great uncertainty.

But CloudFormation does have drift detection: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...

I'd pick Terraform before CloudFormation, but there are things that are better with CF, such as rollbacks (they really do work as expected in almost all cases), and AutoScalingGroup's UpdatePolicy (rolling/replacing deploy of new launch configuration with healthchecks), which is not available outside of CF.

View on HN

> AutoScalingGroup's UpdatePolicy (rolling/replacing deploy of new launch configuration with healthchecks), which is not available outside of CF.

This drives me crazy. I never want to touch CF, but if I want rolling ASG, I have to. Why?!?

Drift detection is only implemented for a very small subset of resources: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...

For a concrete example of one that bit us one time, database parameter groups don't support drift detection.

There are a lot of issues with both cfn and tf. As always,it comes down use-case.

In my opinion, tf is terrible choice unless you're going to be using it for more than AWS

Or if you want to use AWS features on a deterministic timescale: CloudFormation frequently lags on support for new features - I’ve worked on multiple projects which used Terraform for months before the equivalent feature could be used in CloudFormation. For example, when ECS launched secrets support it took most of a year before CF was updated.

This is a big deal with classic CloudFormation because there was no escape hatch. Terraform can run arbitrary code if needed but you had to split CF stacks apart so you could have something else run in between. That’s probably better with CDK, of course.

CloudFormation has an escape hatch via custom resources, which can call Lambda functions do create/update/destroy resources. It's ugly, but it works.

Good point: they added that feature after I stopped using it but it’s a good option for some cases, especially if you want to do things which the caller shouldn’t be allowed to directly perform.

At my old place we had some automation around this. Essentially our custom resources was mostly just the python scripts and then any deviations from the basic custom resource definition. Made life a lot easier.

Reply on news.ycombinator.com