Hacker News Reader

Comment by borplk | Hacker News Reader

I recently had to do a piece of AWS work that required cross-account resources (create certificate in one account with ACM, set DNS entries on Route53 in another account).

Not sure about pulumi, but AWS CDK and CloudFormation can't handle that as one step (there are some horrific hacks). With Terraform it's absolutely trivial.

I was liking CDK up to that point, but that limitation is a complete deal breaker for me. Had to come back to my old friend Terraform.

View on HN

Have you seen Terraform CDK? https://github.com/hashicorp/terraform-cdk

A CDK-style Terraform seems perfect. Seems a bit early days but I look forward to it gaining traction.

There are dozens of these examples. I switched a few years back after AWS released the automataic HTTP to HTTPS redirect functionality in ALBs and 6 months after release it still wasn't supported in CF. Terraform isn't perfect and it still has a ton of isues but it's rate of innovation is way a head of CF.

This is pretty straightforward in Pulumi. I recently built a stack that, in a single `pulumi up`, creates VPCs and subnets in a handful of different accounts with VPC peering, routing and DNS between each of them, including an AWS Client VPN set up so you can access all the VPCs from a single VPN endpoint.

Not sure if this official guidance is a 'horrific hack' but there are official AWS guidance on how to do this:

https://aws.amazon.com/blogs/infrastructure-and-automation/m...

Thank you, and yes in my books that's a horrific hack and too much effort compared to the 5 lines of code I just added to Terraform to get the job done.

I think the root reason for this is AWS stacks have to authenticate from a single origin (i.e. user credentials) instead of Terraform which can utilize multiple auths. This makes it necessarily complicated for AWS stacks when it tries to deploy another stack in another account, as the stacks are also account based. (but I imagine terraform stacks isn't).

FYI this has been supported in CDK for a few months now. See the CrossAccountZoneDelegation at the end of this section: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-route53-...

Reply on news.ycombinator.com