Infrastructure as Code has gained a lot of traction within DevOps culture over the past ten years and brought significant changes how we manage IT infrastructure and its lifecycle. We want to deploy it as efficiently and frictionless as possible and there are many different tools available we can choose from. Using off-the-shelf SaaS solution can save us a lot of time and other resources needed to achieve that. At HashiConf'19 Terraform Cloud was announced and made generally available, which confirms IaC is getting more commodified and easily available as SaaS product. This talk will focus on a detailed overview of Terraform Cloud features, such as remote execution, state/lock management, private modules/registry and others. Further it will examine how is Terraform Cloud abstracting complexity and amending current infrastructure deployment workflows. We will also look into CI/CD integration, collaboration features and discuss current shortcomings with possible upcoming features.

2. COMMODIFIED IaC USING
TERRAFORM CLOUD_
Marko Bevc

3. COMMON
COMMODITIES_

4. POWER AS
COMMODITY_

5. REFINING &
ADOPTING_
S. Wardley: value chain mapping
Thoughts
and ideas
Solution
attempts
Solution to
known problems
Refinement
of solutions
Very little
knowledge
Lots of
knowledge
product
Problem
definition
Solution
identification
Standardization
of solution
Industrialization
of solution
New
problems
Gartner: hype cycle

6. ABOUT
ME_ ●
Senior IT Consultant at The Scale Factory (DevOps consultancy,
AWS advanced consulting partner and K8s service provider)
●
IT system engineering background with extensive Linux and
virtualization experience
●
Certifications and competencies: AWS, CKA, RHEL, Hashi stack
●
Open source contributor and supporter
●
Fan of automation/simplifying things, hiking, cycling and travelling

7. TALK
AGENDA_
• Infrastructure as Code
• Terraform Cloud
• Abstracting complexity
• Automation and CI/CD integration
• Demo
• Conclusions and takeaways

8. INFRASTRUCTURE
AS CODE_
• Key attribute for enabling good DevOps practices:
– breaking organisational silos
– multi-team collaboration
• State visibility across estate
• Disposable infrastructure and reproducibility
• Higher delivery velocity and automation
• Better testing and lowering risk of errors

9. TERRAFORM
CLOUD_
• GA announced at HashiConf’19
• Extensible SaaS solution (API, registries, plug-ins)
• Abstraction of Terraform complexity
• Safe: 2-factor authentication & Vault secrets
• Collaboration: VCS integration, notifications, team
management and Web UI/API
• Fine-grained control: Sentinel policies, user roles,
cost estimation
• 160+ available providers

10. TERRAFORM CLOUD
ARCHITECTURE_
Cloud / Enterprise
OSS CLI
Source: https://www.terraform.io/

11. ABSTRACTING
COMPLEXITY_
●
Delegation of responsibility:
– State and lock management
– Remote/local execution & speculative plans
– Unified workflows
– Notifications
– Web UI
●
Same approach and structures (API / HCL)
●
Changing infrastructure deployment perspective
●
Of-the-shelf SaaS solution – commodity?

12. AUTOMATION
AND PIPELINES_
• Integration with major VCS providers: GitHub, GitLab, Bitbucket,
Azure DevOps
• Containers used as runtime (Terraform version)
• Auto or manual approvals
• Variables/secrets & state access using:
– TFE provider resources, i.e. tfe_variable
– terraform_remote_state data resource
• Private repositories and providers
• Caveats:
– Overwrites terraform.tfvars → *.auto.tfvars
– Special vars: CONFIRM_DESTROY, TFE_PARALLELISM

13. HOW TO
START_
●
Create organisation: team & workspaces
●
Two factor authentication (TOTP, SMS)
●
VCS integration
●
Credential tokens
●
Remote backend configuration
●
Workspace creation – automatically with
remote backend
●
API tokens, SSH keys & policies*

14. $ cat ~/.terraformrc
--------------------
plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"
disable_checkpoint = true
credentials "app.terraform.io" {
token = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
}
backend.tf:
-----------
terraform {
backend "remote" {
organization = "my-org"
workspaces {
name = "demo-tf-remote"
}
}
}

15. REMOTE
RUNS_
•

16. TIME FOR
DEMO!_

17. CONCLUSIONS_
& TAKEAWAYS
●
Complexity delegation (state, locking, execution, ...)
●
Automation and deployment workflow integration
●
Careful not storing/emitting secrets in configurations and logs
●
Non-free and beta features: cost estimation, polices, run triggers, ...
●
Room for improvement: default is remote, custom Docker images,
cloud SAML/SSO and audit logs/compliance,…
●
Shift left practice and platform convergence (multi/poly-cloud) →
IaC as software delivered commodity

18. CONTACTS_
&
RESOURCES
●
“Make things as simple as possible, but not simpler.” A. Einstein
●
Twitter: @_MarkoB
●
GitHub / GitLab: @mbevc1
●
LinkedIn: https://www.linkedin.com/in/marko-bevc/
●
Resources:
– https://www.thehistoricalarchive.com/happenings/57/the-history-of-elec
tricity-a-timeline/
– https://en.wikipedia.org/wiki/Wardley_map
– https://en.wikipedia.org/wiki/Hype_cycle
– https://en.wikipedia.org/wiki/Infrastructure_as_code
– https://terraform.cloud
– https://www.hashicorp.com/cloud-operating-model
– https://www.terraform.io/docs/cloud/run/cli.html
– https://www.hashicorp.com/products/terraform/pricing/