![old json
"UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -xen",
"yum install -y aws-cfn-bootstrapn",
"/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource LaunchConfig ",
" --region ", { "Ref" : "AWS::Region" }, "n",
"/opt/aws/bin/cfn-signal -e $? ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource WebServerGroup ",
" --region ", { "Ref" : "AWS::Region" }, "n"
]]}}
}
13](https://image.slidesharecdn.com/terraform-ansible-or-cloudfront-170522132945/85/Terraform-Ansible-or-pure-CloudFormation-19-320.jpg)
Terraform, Ansible, or pure CloudFormation?
- 1. Terraform, Ansible, or pure CloudFormation? Vladimir Dobriakov AWS User Group Cologne, May 2017
- 2. Task/Context
- 4. implementation Hosting - 400 VMs in OpenStack public cloud - moving to private cloud and kubernetes - some AWS People - 35 Dev - 9 Ops 2
- 5. our aws usage AWS Use Case 1: Media Assets AWS Use Case 2: DB Backup Offsite DB backup for SQL databases. 3
- 6. Terraform
- 7. terraform: nice syntax resource "aws_iam_user" "deploy_user" { name = "deploy-${var.topic}${var.suffix}" } resource "aws_iam_access_key" "deploy_user" { user = "${aws_iam_user.deploy_user.name}" } resource "aws_s3_bucket" "the_bucket" { bucket = "${data.template_file.bucket_name.rendered}" policy = <<EOF ... "Principal": {"AWS": "${aws_iam_user.deploy_user.arn}"} } output access_key_id { value = "${aws_iam_access_key.deploy_user.id}" } 4
- 8. terraform advantages • nice, clean syntax • examples very readable, takes fear from starting infrastructure as code • plan feature 5
- 10. terraform challenges: resources docs Terraform is not an abstraction layer across providers! Need to dive into AWS docs anyway: resource "aws_s3_bucket" "the_bucket" { bucket = "${data.template_file.bucket_name.rendered}" cors_rule { expose_headers = ??? 6
- 11. terraform challenges: resources docs Terraform documentation https://www.terraform.io/docs/providers/aws/r/s3 bucket.html AWS documentation 7
- 12. terraform challenges: syntax break Sometimes requires copy+paste from AWS console: resource "aws_s3_bucket" "the_bucket" { bucket = "${data.template_file.bucket_name.rendered}" acl = "private" website { index_document = "index.html" } policy = <<EOF { "Version": "2008-10-17", "Statement": [ { "Sid": "PublicReadForGetTestBucketObjects", "Effect": "Allow", "Principal": "*", 8
- 13. terraform challenges: endless updates due diff problems Terraform documentation https://github.com/hashicorp/terraform/issues/7045 9
- 14. terraform challenges: tfstate • Working with 9 people on same terraform code base • Terraform versions • Refactoring: extract to module changes resource names • Refactoring: move objects with tf state mv -state=terraform.tfstate.prod module.publish media prod module.publish media 10
- 15. Ansible
- 17. set up backup bucket tasks: - name: Create backup aws user iam: iam_type: user name: "{{ backup_user_name }}" state: present access_key_state: create register: created_user # need this name for the template - name: Create backup bucket s3_bucket: name: "{{ backup_bucket_name }}" policy: "{{ lookup(’template’, ’bucket_policy.json.j2’) }}" versioning: true # to enable trash bin register: backup_bucket - name: Set retention for backups s3_lifecycle: name: "{{ backup_bucket_name }}" expiration_days: 30 12
- 18. CloudFormation
- 19. old json "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [ "#!/bin/bash -xen", "yum install -y aws-cfn-bootstrapn", "/opt/aws/bin/cfn-init -v ", " --stack ", { "Ref" : "AWS::StackName" }, " --resource LaunchConfig ", " --region ", { "Ref" : "AWS::Region" }, "n", "/opt/aws/bin/cfn-signal -e $? ", " --stack ", { "Ref" : "AWS::StackName" }, " --resource WebServerGroup ", " --region ", { "Ref" : "AWS::Region" }, "n" ]]}} } 13
- 20. cloudformation yaml UserData: Fn::Base64: !Sub | #!/bin/bash -xe yum update -y aws-cfn-bootstrap /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfig --region ${AWS::Region} /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerGroup --region ${AWS::Region} 14
- 21. Which one to choose?
- 22. terraform Inspired the whole industry, even in Redmond Use it, if: • your infrastructure fits into single .tf file • 1-3 people work closely and continuously on same tf code base • already invested in tf, stick to it! 15
- 23. learn aws! Try to implement with CloudFormation first! • learn access and identity management (IAM) concepts • refer to permissions list http://amzn.to/2pPnT1p to implement principle of least privelege • use CloudFormation YAML format 16
- 24. orchestrate with ansible if needed • for more sophisticated templating and logic • when using multiple clouds • to store some state locally, e.g. generated credentials • to look up some state/parameters elsewhere 17
- 25. Thank you! 18
- 26. contact Vladimir Dobriakov Twitter: @enterprise geek github: geekQ Blog http://infrastructure-as-code.de Reinventing the Wheel https://github.com/Galeria-Kaufhof/private-postgres-rds 19