4 ms·
I recently had to do a piece of AWS work that required cross-account resources (create certificate in one account with ACM, set DNS entries on Route53 in anothe
by borplk 5y ago
I recently had to do a piece of AWS work that required cross-account resources (create certificate in one account with ACM, set DNS entries on Route53 in another account).
Not sure about pulumi, but AWS CDK and CloudFormation can't handle that as one step (there are some horrific hacks). With Terraform it's absolutely trivial.
I was liking CDK up to that point, but that limitation is a complete deal breaker for me. Had to come back to my old friend Terraform.
- ciisforsuckas 5y agoThere are dozens of these examples. I switched a few years back after AWS released the automataic HTTP to HTTPS redirect functionality in ALBs and 6 months after release it still wasn't supported in CF. Terraform isn't perfect and it still has a ton of isues but it's rate of innovation is way a head of CF.
- Aperocky 5y agoNot sure if this official guidance is a 'horrific hack' but there are official AWS guidance on how to do this: https://aws.amazon.com/blogs/infrastructure-and-automation/multiple-account-multiple-region-aws-cloudformation/ https://aws.amazon.com/blogs/infrastructure-and-automation/m...
- borplk 5y agoThank you, and yes in my books that's a horrific hack and too much effort compared to the 5 lines of code I just added to Terraform to get the job done.
- Aperocky 5y agoI think the root reason for this is AWS stacks have to authenticate from a single origin (i.e. user credentials) instead of Terraform which can utilize multiple auths. This makes it necessarily complicated for AWS stacks when it tries to deploy another stack in another account, as the stacks are also account based. (but I imagine terraform stacks isn't).
- lukev 5y agoThis is pretty straightforward in Pulumi. I recently built a stack that, in a single `pulumi up`, creates VPCs and subnets in a handful of different accounts with VPC peering, routing and DNS between each of them, including an AWS Client VPN set up so you can access all the VPCs from a single VPN endpoint.
- MehdiHK 5y agoHave you seen Terraform CDK? https://github.com/hashicorp/terraform-cdk https://github.com/hashicorp/terraform-cdk
- borplk 5y agoA CDK-style Terraform seems perfect. Seems a bit early days but I look forward to it gaining traction.
- Hawxy 5y agoFYI this has been supported in CDK for a few months now. See the CrossAccountZoneDelegation at the end of this section: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-route53-readme.html#adding-records https://docs.aws.amazon.com/cdk/api/latest/docs/aws-route53-...