4 ms·
> With lack of drift detection comes great uncertainty. But CloudFormation does have drift detection: https://docs.aws.amazon.com/AWSCloudFormation/latest/User
by watermelon0 6y ago
> With lack of drift detection comes great uncertainty.
But CloudFormation does have drift detection: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
I'd pick Terraform before CloudFormation, but there are things that are better with CF, such as rollbacks (they really do work as expected in almost all cases), and AutoScalingGroup's UpdatePolicy (rolling/replacing deploy of new launch configuration with healthchecks), which is not available outside of CF.
- mike503 6y ago> AutoScalingGroup's UpdatePolicy (rolling/replacing deploy of new launch configuration with healthchecks), which is not available outside of CF. This drives me crazy. I never want to touch CF, but if I want rolling ASG, I have to. Why?!?
- dastx 6y agoThere are a lot of issues with both cfn and tf. As always,it comes down use-case. In my opinion, tf is terrible choice unless you're going to be using it for more than AWS
- acdha 6y agoOr if you want to use AWS features on a deterministic timescale: CloudFormation frequently lags on support for new features - I’ve worked on multiple projects which used Terraform for months before the equivalent feature could be used in CloudFormation. For example, when ECS launched secrets support it took most of a year before CF was updated. This is a big deal with classic CloudFormation because there was no escape hatch. Terraform can run arbitrary code if needed but you had to split CF stacks apart so you could have something else run in between. That’s probably better with CDK, of course.
- synthc 6y agoCloudFormation has an escape hatch via custom resources, which can call Lambda functions do create/update/destroy resources. It's ugly, but it works.
- acdha 6y agoGood point: they added that feature after I stopped using it but it’s a good option for some cases, especially if you want to do things which the caller shouldn’t be allowed to directly perform.
- dastx 6y agoAt my old place we had some automation around this. Essentially our custom resources was mostly just the python scripts and then any deviations from the basic custom resource definition. Made life a lot easier.
- ReidZB 6y agoDrift detection is only implemented for a very small subset of resources: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift-resource-list.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui... For a concrete example of one that bit us one time, database parameter groups don't support drift detection.