OK, you are convinced, that infrastructure-as-code (managing computing resources, networks, configuring services through machine-readable definition files, rather than interactive configuration tools) is the way to go! But do not know, which technology to use for it? Should I learn Terraform, do I need to buy Atlas, is Ansible really enough to implement everything? Will my code stay maintainable in 3 or 5 years? We will have a look at a small, but real world task, consider implementations with all the mentioned tools and we will also discuss, which tools give you advantages in which specific situations

1. Terraform, Ansible, or pure
CloudFormation?
Vladimir Dobriakov
AWS Tech Community Days
Cologne, September 27th and 28th

2. infrastructure coder
Infrastructure as Code
• put under source control:
diffable, traceable, reproducible
• aim for simplicity - orthogonal concepts
• unit tests, integration tests and CI
1

3. Task/Context

4. 3

5. implementation
Hosting
- 400 VMs in OpenStack
public cloud
- moving to private cloud
- moved applications
to kubernetes
- some AWS
People
- 40 dev
(5 teams)
- 10 ops
24x7
4

6. our aws usage
AWS Use Case 1: Media
Assets
AWS Use Case 2: DB
Backup
Offsite DB backup for
SQL databases.
5

7. Terraform

8. terraform: nice syntax
resource "aws_iam_user" "deploy_user" {
name = "deploy-${var.topic}${var.suffix}"
}
resource "aws_iam_access_key" "deploy_user" {
user = "${aws_iam_user.deploy_user.name}"
}
resource "aws_s3_bucket" "the_bucket" {
bucket = "${data.template_file.bucket_name.rendered}"
policy = <<EOF
...
"Principal": {"AWS": "${aws_iam_user.deploy_user.arn}"}
}
output access_key_id {
value = "${aws_iam_access_key.deploy_user.id}"
}
7

9. terraform advantages
• nice, clean syntax
• examples very readable, takes fear from
starting infrastructure as code
• ”plan” feature
8

10. Terraform Challenges

11. terraform challenges: resources docs
Terraform is not an abstraction layer
across providers!
Need to dive into AWS docs anyway:
resource "aws_s3_bucket" "the_bucket" {
bucket = "${data.template_file.bucket_name.rendered}"
cors_rule {
expose_headers = ???
10

12. terraform challenges: resources docs
Terraform documentation
https://www.terraform.io/docs/providers/aws/r/s3 bucket.html
AWS documentation
11

13. terraform challenges: syntax break
Sometimes requires copy+paste from AWS
console:
resource "aws_s3_bucket" "the_bucket" {
bucket = "${data.template_file.bucket_name.rendered}"
acl = "private"
website {
index_document = "index.html"
}
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "PublicReadForGetTestBucketObjects",
"Effect": "Allow",
"Principal": "*",
12

14. terraform challenges: endless updates due
diff problems
Terraform documentation
https://github.com/hashicorp/terraform/issues/7045 13

15. terraform challenges: tfstate
• Working with 9 people on same terraform
code base
• Terraform versions
• Refactoring: extract to module changes
resource names
• Refactoring: move objects with
tf state mv -state=terraform.tfstate.prod
module.publish media prod
module.publish media
14

16. Ansible

17. ansible cloud modules
16

18. set up backup bucket
tasks:
- name: Create backup aws user
iam:
iam_type: user
name: "{{ backup_user_name }}"
state: present
access_key_state: create
register: created_user # need this name for the template
- name: Create backup bucket
s3_bucket:
name: "{{ backup_bucket_name }}"
policy: "{{ lookup(’template’, ’bucket_policy.json.j2’) }}"
versioning: true # to enable trash bin
register: backup_bucket
- name: Set retention for backups
s3_lifecycle:
name: "{{ backup_bucket_name }}"
expiration_days: 30
17

19. CloudFormation

20. old json
"UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -xen",
"yum install -y aws-cfn-bootstrapn",
"/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource LaunchConfig ",
" --region ", { "Ref" : "AWS::Region" }, "n",
"/opt/aws/bin/cfn-signal -e $? ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource WebServerGroup ",
" --region ", { "Ref" : "AWS::Region" }, "n"
]]}}
}
19

21. cloudformation yaml
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
yum update -y aws-cfn-bootstrap
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName}
--resource LaunchConfig --region ${AWS::Region}
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName}
--resource WebServerGroup --region ${AWS::Region}
20

22. Which one to choose?

23. learn aws!
Try to implement with CloudFormation first!
• learn access and identity management
(IAM) concepts
• refer to permissions list
http://amzn.to/2pPnT1p to implement
principle of least privelege
• use CloudFormation YAML format
22

24. orchestrate with ansible if needed
• for more sophisticated templating and
logic
• when using multiple clouds
• to store some state locally, e.g. generated
credentials
• to look up some state/parameters
elsewhere
23

25. Thank you!
24

26. contact
Vladimir Dobriakov
available for consulting
Twitter: @enterprise geek
github: geekQ
Blog
http://infrastructure-as-code.de
25