5 ms·
I feel you. I do take the risk – the leverage on automation and manageability that Terraform e.a. give me are just too good to pass, and only with a 100% API ap
by ManuelKiessling 5y ago
I feel you. I do take the risk – the leverage on automation and manageability that Terraform e.a. give me are just too good to pass, and only with a 100% API approach like AWS provides it can I play the 100% infrastructure-as-code game, and I simply won't play any other game anymore.
Through the very same means, first thing I do with every new AWS-based project is setting up a cleanly organized Org with centralized billing, centralized IAM&Roles, centralized billing alarms, centralized SCP limitations(!!!) (as in “I will never run anything in Southeast Asia, so I disallow anything in Southeast Asia for all Org accounts), and very not-centralized resources per stage/subproject/vertical/whatever.
Plus sensible service limits on everything that has a service limit (request on API gateway etc.).
But as someone here said: your risk will remain > 0, you just have to accept that.
- whichquestion 5y agoDigitalOcean has a terraform provider you can use for an IaC approach
- atmosx 5y agoDO doesn’t offer accounting in services (who accessed what and when), no IAM which is a huge problem and their APIs and services are a bit low on reliability. Spaces has extremely low rate limit and their communication API time outs often. The k8s service works overall but has some annoying hiccups that only support tickets will fix, the CDN returns random 503 errors. All droplets are shared and resource contention is a thing. That said, AWS support has its own issues, rarely solving the problem even when we pay for a TAM. Services like elasticache are hard to upgrade with zero downtime. Their solutions always involved spending inordinate amounts of money on open source clones with 1/10 of features and their good services (DynamoDB) will cost an arm and a leg. My 2 cents.