Hacker News Reader

Comment by bmurphy1976 | Hacker News Reader

bmurphy1976·

Having to reference security groups by id instead of name in cloudformation stacks, terraform, and a variety of other places is one of the most infuriating things. Makes everything much more difficult to configure and maintain because the IDs are so opaque and unique. Somebody has to do the grunt work of looking them and and copy/pasting them or writing scripts to propagate configuration forward. What a waste of time and effort.

View on HN

In terraform you should never be using IDs directly unless it's in a variable or, preferably, a data source. The reference should look like aws_something.mything.id.

Since you mention cloudformation here my tips to make it easier: - tag all groups so its easier to remember - use Export in outputs so you can use ImportValue in other templates - use only cloudformation, no edit/create/add actions in the console

Now the ID thing is 0 problems as you never have to worry about them anymore

Same goes for terraform or any other InfrastructureAsCode

I agree, it's frustrating. However, considering you can share security groups, and even share VPC as a resource to different AWS accounts, and that "names" are non-unique, how would you solve the problem of allowing people to select a non-unique resource and know which one they actually mean.

It's a pain, sure, but there's no better solution... explicitness creates certainty in this case..

You would use the arns. Those are unique but predictable.

Reply on news.ycombinator.com