Hacker News Reader

Comment by jhugo | Hacker News Reader

Never ever use the dashboard to configure your production deployments, on any cloud. From the moment you create the account, use automation (Terraform, provider-specific stuff like CF, whatever) to create resources. The learning curve is not that big, and you will have certainty about, and control over, what is running in your account.

View on HN

I disagree. If you don't fundamentally understand how the services work on their own, or how to repair them outside of your selected framework, you're setting yourself up for failure down the road.

You'll also have very little visibility in how to effectively test your configuration and ensure the security you _think_ you have is actually in place and functioning correctly.

I'm not suggesting any type of "framework" (which suggests inversion of control). Terraform, CF, etc make the same API calls that the console does, they just keep state. Whether you understand the services is orthogonal to whether you use automation to deploy them.

Does AWS have a way to export your infrastructure to a terraform file? Like if I start doing things via the dashboard and later want to use terraform?

No, but Terraform has a way of importing it (via the `terraform import` command), although it is clunky to use for an account with lots of resources.

CloudFormation (the AWS-provided IaC product) may have something, though.

I saw "aws-prod-infrastructure" and "terragen" on the AWS blog recently, which are claimed to solve this. I haven't tried them.

I've used terraformer. It generates a bunch of HCL that's useful but verbose, and you can target certain kinds of resources with it. It'll do in a pinch but can't say I loved it.

Every time I use Terraform I want to make a Lisp dialect that describes cloud infrastructure.

emacs probably has one… :-p

Emacs is the best OS I've ever used.

Terraform has the ability to import it

In my experience you need to find each resource one by one, and then import each one. Sometimes by name, some by ARN, some by something else. The import approach is time consuming.

Reply on news.ycombinator.com