3 ms·
The main problem is it's a huge time suck. When writing IAC like Terraform, you'll probably spend more time configuring IAM roles and permissions than you do th
by icedchai 2y ago
The main problem is it's a huge time suck. When writing IAC like Terraform, you'll probably spend more time configuring IAM roles and permissions than you do the actual infrastructure. Also, in my experience, nobody reviewing your code will check if it's correct, least privilege, etc. And when you get it wrong (too restrictive), the error messages can be difficult to diagnose, depending on the service. So most people will err on the side of more permissions than needed.
- presspot 2y agoI have hard this from many developers. Are there any good solutions or best practices I should look into?
- guiriduro 2y agoFor the security sanity checking of terraform infra code, take a look at Checkov.
- turtlebits 2y agoDon't use Terraform? If you want to create individual resources one by one, go for it. Use something like CDK which abstracts a lot of the boilerplate away.
- icedchai 2y agoI wound up with a job at a TF-heavy company. I personally despise Terraform. The language is anemic and there's too much copy-paste code.
- sgarland 2y ago…and compiles into CloudFormation, which is of the devil. I also have issues with infrastructure being declared imperatively. I’ve seen countless bugs and incidents caused by CDK surprises. You get precisely what you ask for with a declarative language.