7 ms·

I don't support the CF is would have been easier than TF argument The CF console is opaque, slow and worst of all lazy evaluates. This is exacerbated when doin

I don't support the CF is would have been easier than TF argument The CF console is opaque, slow and worst of all lazy evaluates. This is exacerbated when doing anything docker service related. If you make a mistake it can be three hours before an update timeout is triggered, then another three hours for a rollback to complete. The other _really_ annoying thing is that TF gets the features first. For example its not possible with CF to use SSM variables in environment vars. But as TF uses the AWS API, it can. I dislike TF because I've not used it overly much, and it makes me have horror flashbacks of puppet. However, what you say about the lambda is basically spot on. They are much simpler and easer, "true" serverless if you will. Or more likly /cgi-bin/lambda, if you are old enough.

scarface74 8y ago
The CF console is opaque, slow and worst of all lazy evaluates. This is exacerbated when doing anything docker service related. If you make a mistake it can be three hours before an update timeout is triggered, then another three hours for a rollback to complete. How is it opaque? It’s a wizard that lets you upload a template from a file or S3. Most of the time though it’s part of my CodePipeline anyway. I don’t use the console in day to day use. For a quick and dirty I use the CLI. The other _really_ annoying thing is that TF gets the features first. For example its not possible with CF to use SSM variables in environment vars. But as TF uses the AWS API, it can. Yes you can.... https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/ https://aws.amazon.com/blogs/mt/integrating-aws-cloudformati... But there is one benefit to CloudFormation if you have the business support plan - AWS’s chat support is excellent.
- village-idiot 8y ago
  CF regularly lacks features that TF has, but the list of features is constantly changing as Amazon release new features and CF eventually catches up. The one that got me this week was that CF cannot define global Dynamo tables, you have to find an alternative way to turn them on.
  - scarface74 8y ago
    Or just do a quick Google search for a custom resource.... https://github.com/kspurrier/cfn-dynamodb-global-table/blob/master/README.md https://github.com/kspurrier/cfn-dynamodb-global-table/blob/...
    - village-idiot 8y ago
      Ignoring the obnoxiousness of “just google it” replies, I would consider having to write a custom lambda function to enable global tables to be well within the realm of “CF doesn’t support it”. Our experience also shows that custom resources can go into a 3 hour timeout cycle if you don’t handle error cases in your lambda perfectly, making them a sub-par development experience.
      - scarface74 8y ago
        Well, if you had an issue with Terraform wouldn't you first look to see if there were already a module for it? But in the case of "global" tables, they are by definition cross region and CloudFormation stacks are per region. Looking at the code from the link... for region in event['ResourceProperties']['ReplicationGroupList']: replication_group.append({ 'RegionName': region}) It is doing stuff across regions.
- KaiserPro 8y ago
  yes, I can resolve SSM variables into plain text, however key rotation requires re-deploy. (unless I'm missing something here) However the new feature where you just dump in the SSM name in the environment variable and it unencrypts at execution is not supported in CF yet. It was the same ECS/fargate/batch task creation for a long time. As for the CF Console, its the same data in the CLI or on the web, the data comes from the same point. 1) it lazy evaluates, so it gets 90% of the way through a deploy only to find that there is a spelling mistake. That is inexcusable. 2) yes you can download the template via S3, but if you have a circular dependency, it won't tell you the line numbers. It won't even tell you the occurrences that are causing it to be over constrained. 3) It won't tell you the order in which your stuff will come up.
  - scarface74 8y ago
    For automatic key rotation you use the new Secrets Manager. 1) there are cloud formation linters. 2) It will tell you the resource name 3) it creates a dependency graph. It only knows when things come up based on when the underlying API call returns. How else would it know until execution time?
    - KaiserPro 8y ago
      > key rotation you use the new Secrets Manager. True, but that gets very expensive very quickly. We keep all our config for each environment in SSM pretty cheaply. (we have >1000 config items, most of which aren't and don't need encryption)h We basically treat SSM like Vault from hashicorp 1) We have a linters in the CI pipeline, they help but are not perfect. 2) true, but not where the references are, thats the killer bit. If you have > two people working on a script, and they each put in a !Ref or !GetAtt, its exceptionally difficult to debug. 3) once you have a dependency graph, you know the order in which things come up. You need to generate the graph before you start calling APIs. For example, you have a a property that you've spelt wrong, isn't the right data type, or isn't valid for that type of config. All of those can be evaluated when the dependency graph is generated. However, they are not, they are differed to when the API is called. This gets very tedious if you are using anything ECS/fargate/rds, as the debug loop can be > 3 hours. This can be mitigated if you use uniquely named items, allowing multiple stacks.
whoevercares 8y ago
It’s 2019, CDK is almost there

scarface74 8y ago

The CF console is opaque, slow and worst of all lazy evaluates. This is exacerbated when doing anything docker service related. If you make a mistake it can be three hours before an update timeout is triggered, then another three hours for a rollback to complete. How is it opaque? It’s a wizard that lets you upload a template from a file or S3. Most of the time though it’s part of my CodePipeline anyway. I don’t use the console in day to day use. For a quick and dirty I use the CLI. The other _really_ annoying thing is that TF gets the features first. For example its not possible with CF to use SSM variables in environment vars. But as TF uses the AWS API, it can. Yes you can.... https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/ https://aws.amazon.com/blogs/mt/integrating-aws-cloudformati... But there is one benefit to CloudFormation if you have the business support plan - AWS’s chat support is excellent.

village-idiot 8y ago
CF regularly lacks features that TF has, but the list of features is constantly changing as Amazon release new features and CF eventually catches up. The one that got me this week was that CF cannot define global Dynamo tables, you have to find an alternative way to turn them on.
- scarface74 8y ago
  Or just do a quick Google search for a custom resource.... https://github.com/kspurrier/cfn-dynamodb-global-table/blob/master/README.md https://github.com/kspurrier/cfn-dynamodb-global-table/blob/...
  - village-idiot 8y ago
    Ignoring the obnoxiousness of “just google it” replies, I would consider having to write a custom lambda function to enable global tables to be well within the realm of “CF doesn’t support it”. Our experience also shows that custom resources can go into a 3 hour timeout cycle if you don’t handle error cases in your lambda perfectly, making them a sub-par development experience.
    - scarface74 8y ago
      Well, if you had an issue with Terraform wouldn't you first look to see if there were already a module for it? But in the case of "global" tables, they are by definition cross region and CloudFormation stacks are per region. Looking at the code from the link... for region in event['ResourceProperties']['ReplicationGroupList']: replication_group.append({ 'RegionName': region}) It is doing stuff across regions.
KaiserPro 8y ago
yes, I can resolve SSM variables into plain text, however key rotation requires re-deploy. (unless I'm missing something here) However the new feature where you just dump in the SSM name in the environment variable and it unencrypts at execution is not supported in CF yet. It was the same ECS/fargate/batch task creation for a long time. As for the CF Console, its the same data in the CLI or on the web, the data comes from the same point. 1) it lazy evaluates, so it gets 90% of the way through a deploy only to find that there is a spelling mistake. That is inexcusable. 2) yes you can download the template via S3, but if you have a circular dependency, it won't tell you the line numbers. It won't even tell you the occurrences that are causing it to be over constrained. 3) It won't tell you the order in which your stuff will come up.
- scarface74 8y ago
  For automatic key rotation you use the new Secrets Manager. 1) there are cloud formation linters. 2) It will tell you the resource name 3) it creates a dependency graph. It only knows when things come up based on when the underlying API call returns. How else would it know until execution time?
  - KaiserPro 8y ago
    > key rotation you use the new Secrets Manager. True, but that gets very expensive very quickly. We keep all our config for each environment in SSM pretty cheaply. (we have >1000 config items, most of which aren't and don't need encryption)h We basically treat SSM like Vault from hashicorp 1) We have a linters in the CI pipeline, they help but are not perfect. 2) true, but not where the references are, thats the killer bit. If you have > two people working on a script, and they each put in a !Ref or !GetAtt, its exceptionally difficult to debug. 3) once you have a dependency graph, you know the order in which things come up. You need to generate the graph before you start calling APIs. For example, you have a a property that you've spelt wrong, isn't the right data type, or isn't valid for that type of config. All of those can be evaluated when the dependency graph is generated. However, they are not, they are differed to when the API is called. This gets very tedious if you are using anything ECS/fargate/rds, as the debug loop can be > 3 hours. This can be mitigated if you use uniquely named items, allowing multiple stacks.

whoevercares 8y ago

It’s 2019, CDK is almost there