3 ms·
State is only required because Terraform is not truly declarative. If you have a VM instance running that is not defined in your code, it just gets left alone b
by c7DJTLrn 3y ago
State is only required because Terraform is not truly declarative. If you have a VM instance running that is not defined in your code, it just gets left alone because it exists outside of TF's view.
If Terraform were truly declarative, all of your infrastructure is represented in code and you don't need state because the only thing it needs to compare with is what's actually there.
However, cloud APIs generally suck, and getting rid of state universally would be almost impossible for other reasons.
- nonameiguess 3y agoYou're underselling what Terraform gets used for here. What happens when you're using Terraform to manage multiple cloud accounts or even multiple cloud providers? Should it be scanning the entire host it runs on for credentials from every possible cloud, check to see that your configuration only includes resources for AWS account #XXXX, and delete everything it finds for any other account and any other provider? Think of the footguns you're introducing if they designed it the way you suggest. What happens when you pass the provider configuration an assume role that you typo or forget to edit correctly but it's still a valid role your user credentials actually have permission to assume? It then deletes every resource that role has the power to delete because you nothing for it defined in that particular root module. Safety is more important than purity or ergonomics or devex here. Heck, that may be the core difference between ops and dev.
- c7DJTLrn 3y ago>It then deletes every resource that role has the power to delete because you nothing for it defined in that particular root module You would see the deletions in the plan and bail out.