4 ms·

Terraform used to be ahead of CloudFormation in AWS features support, but now it's the opposite. If you consider the cost of Terraform Cloud or Enterprise plus

Terraform used to be ahead of CloudFormation in AWS features support, but now it's the opposite. If you consider the cost of Terraform Cloud or Enterprise plus all you need to run and the free CloudFormation, the latter seems like a great deal.

rirze 5y ago
Yah... this kind of feature would be killer for Terraform...
- booi 5y ago
  I can't tell if this should have a /s on it but terraform does have this feature (local-exec, remote-exec) and you don't need Terraform Enterprise, the free one does just fine.
  - xyzzy123 5y ago
    You can also write your own providers etc etc. The whole reason hooks are needed is because you don't have direct access to the execution engine.
    - mh0pe 5y ago
      If you really want access to the execution engine, looks like one team found a way. https://orca.security/resources/blog/aws-cloudformation-vulnerability/ https://orca.security/resources/blog/aws-cloudformation-vuln...
solatic 5y ago
The Hashicorp stack already supported this kind of usecase, it's called Sentinel: https://www.hashicorp.com/sentinel https://www.hashicorp.com/sentinel I do agree that it's a pity that Sentinel isn't free.
- nikolay 5y ago
  Not only it's not free, but it closed-source, too. When others (such as Scalr, Env0, SpaceLift) are using OPA, HashiCorp uses something that's not portable and that's not even using HCL. Their offering ignored not-invented-there tools such as tfsec, tflint, etc. - they only integrated recently with partners, who possibly do revenue sharing with them. Meanwhile, competitors of TFC are not sleeping and innovating way faster (Env0, for example, supports Terragrunt, which fixes many of the core Terraform issues they've been neglecting for years, such as the lack of dynamic providers). The problem is that HashiCorp is dysfunctional for the past two years. Their focus shifted to who knows what, but many providers are barely maintained (such as TLS). They have over 166 engineering jobs openings on their website - you can tell they are struggling! I guess their engineers are too busy interviewing candidates, but I assume their pay rates are below market as the positions keep staying open for months or there's a steady turnover. They jumped on the cdktf bandwagon to compete with Pulumi, but I'm not sure if that's a practical use of their resources especially when it's not even supported by their commercial offering.
  - mh0pe 5y ago
    I never understood this sentiment. Hashicorp offers Sentinel for free [1], publicly. The documentation is also open [2]. There's also open rulesets for CIS benchmarks [3] (minimal but demonstrates what Sentinel can do), and a ton of public drop-in rules for several clouds [4]. There's helpers [5,6] for common use cases, supports custom integrations [7] and it can be run in CI [8]. [1]: https://docs.hashicorp.com/sentinel/downloads https://docs.hashicorp.com/sentinel/downloads [2]: https://docs.hashicorp.com/sentinel/intro/getting-started/rules https://docs.hashicorp.com/sentinel/intro/getting-started/ru... [3]: https://github.com/hashicorp/terraform-foundational-policies-library https://github.com/hashicorp/terraform-foundational-policies... [4]: https://github.com/hashicorp/terraform-guides/tree/master/governance/third-generation/aws https://github.com/hashicorp/terraform-guides/tree/master/go... [5]: https://github.com/hashicorp/terraform-guides/tree/master/governance/third-generation/cloud-agnostic https://github.com/hashicorp/terraform-guides/tree/master/go... [6]: https://github.com/hashicorp/terraform-guides/tree/master/governance/third-generation/common-functions https://github.com/hashicorp/terraform-guides/tree/master/go... [7]: https://github.com/hashicorp/sentinel-sdk https://github.com/hashicorp/sentinel-sdk [8]: https://docs.hashicorp.com/sentinel/commands/apply https://docs.hashicorp.com/sentinel/commands/apply

rirze 5y ago

Yah... this kind of feature would be killer for Terraform...

booi 5y ago
I can't tell if this should have a /s on it but terraform does have this feature (local-exec, remote-exec) and you don't need Terraform Enterprise, the free one does just fine.
- xyzzy123 5y ago
  You can also write your own providers etc etc. The whole reason hooks are needed is because you don't have direct access to the execution engine.
  - mh0pe 5y ago
    If you really want access to the execution engine, looks like one team found a way. https://orca.security/resources/blog/aws-cloudformation-vulnerability/ https://orca.security/resources/blog/aws-cloudformation-vuln...

solatic 5y ago

The Hashicorp stack already supported this kind of usecase, it's called Sentinel: https://www.hashicorp.com/sentinel https://www.hashicorp.com/sentinel I do agree that it's a pity that Sentinel isn't free.

nikolay 5y ago
Not only it's not free, but it closed-source, too. When others (such as Scalr, Env0, SpaceLift) are using OPA, HashiCorp uses something that's not portable and that's not even using HCL. Their offering ignored not-invented-there tools such as tfsec, tflint, etc. - they only integrated recently with partners, who possibly do revenue sharing with them. Meanwhile, competitors of TFC are not sleeping and innovating way faster (Env0, for example, supports Terragrunt, which fixes many of the core Terraform issues they've been neglecting for years, such as the lack of dynamic providers). The problem is that HashiCorp is dysfunctional for the past two years. Their focus shifted to who knows what, but many providers are barely maintained (such as TLS). They have over 166 engineering jobs openings on their website - you can tell they are struggling! I guess their engineers are too busy interviewing candidates, but I assume their pay rates are below market as the positions keep staying open for months or there's a steady turnover. They jumped on the cdktf bandwagon to compete with Pulumi, but I'm not sure if that's a practical use of their resources especially when it's not even supported by their commercial offering.
- mh0pe 5y ago
  I never understood this sentiment. Hashicorp offers Sentinel for free [1], publicly. The documentation is also open [2]. There's also open rulesets for CIS benchmarks [3] (minimal but demonstrates what Sentinel can do), and a ton of public drop-in rules for several clouds [4]. There's helpers [5,6] for common use cases, supports custom integrations [7] and it can be run in CI [8]. [1]: https://docs.hashicorp.com/sentinel/downloads https://docs.hashicorp.com/sentinel/downloads [2]: https://docs.hashicorp.com/sentinel/intro/getting-started/rules https://docs.hashicorp.com/sentinel/intro/getting-started/ru... [3]: https://github.com/hashicorp/terraform-foundational-policies-library https://github.com/hashicorp/terraform-foundational-policies... [4]: https://github.com/hashicorp/terraform-guides/tree/master/governance/third-generation/aws https://github.com/hashicorp/terraform-guides/tree/master/go... [5]: https://github.com/hashicorp/terraform-guides/tree/master/governance/third-generation/cloud-agnostic https://github.com/hashicorp/terraform-guides/tree/master/go... [6]: https://github.com/hashicorp/terraform-guides/tree/master/governance/third-generation/common-functions https://github.com/hashicorp/terraform-guides/tree/master/go... [7]: https://github.com/hashicorp/sentinel-sdk https://github.com/hashicorp/sentinel-sdk [8]: https://docs.hashicorp.com/sentinel/commands/apply https://docs.hashicorp.com/sentinel/commands/apply