This document summarizes a presentation about Terraform best practices and a deep dive into how it works. The presentation covers what Terraform is, how it can be used to implement infrastructure as code from manual processes to collaborative workflows, and why automating infrastructure provides benefits like faster deployments, increased control and predictability. It discusses best practices for Terraform configuration, implementation patterns like separating infrastructure from application code, and sample workflows for deploying infrastructure and platform services.

1. Terraform
Best Practices and Deep Dive
Wojciech Krysmann
June 2018

2. Agenda: What?
How?
Why?

3. /wkrysmann

4. 4
+43
Countries
+350M
+5,000
Employees
+4B
+35
Offices
MAU
Events/Day

5. 5
Horizontals
New Ventures CarsReal Estate
Verticals

6. What?

7. 7
Manual
Semi-automated
Infrastructure as code
Collaborative infrastructure as code
Evolution?

8. 8
Manual
Semi-automated
Infrastructure as code
Collaborative infrastructure as code
Evolution?
Revolution!

9. 9
Manual
Collaborative infrastructure as code

10. How?

11. 11
Rules

12. 12
Greenfield

13. 13
Greenfieldmanual
changesNo

14. 14
Automation

15. 15
General best-practices
DO’s DONT’s
● Review plan prior to apply
● Save plan to file, and apply from it
● $ terraform fmt
● Enable bucket versioning for tfstate
● Do not use ‘-target’
● Do not keep too many resources in one
directory
● Do not create bucket per tfstate
● Don’t keep secrets in repo unencrypted
● Don’t try to build abstract / general
purpose modules

16. 16
Implementation

17. 17
Application
● Application code
● Runtime environment
Platform as a Service
● Instance
● Queue
● Database
Infrastructure as a Service
● VPC, Network, Gateways, ...
● DNS
● CDN
{
{Infrastructure
Service(s)
Feeds data

18. 18
Application
● Application code
● Runtime environment
Platform as a Service
● Instance
● Queue
● Database
Infrastructure as a Service
● VPC, Network, Gateways, ...
● DNS
● CDN
{
{Infrastructure
Service(s)
Feeds data

19. Infrastructure repo

20. Infrastructure repo

21. ⇐ Provider
⇐ Environment
⇐ Region
⇐ Project
⇐ Service
⇐ Code
⇐ Service
⇐ Code
Infrastructure repo

22. 22
Application
● Application code
● Runtime environment
Platform as a Service
● Instance
● Queue
● Database
Infrastructure as a Service
● VPC, Network, Gateways, ...
● DNS
● CDN
{
{Infrastructure
Service(s)
Feeds data

23. ⇐ infrastructure catalog
⇐ Provider
⇐ Environment
⇐ Region
⇐ Code
App repo

24. main.tf (infra repo)

25. main.tf (app repo)

26. main.tf (app repo)
Data feed from infra repo ⇒
Data feed from infra repo ⇒

27. 27
Application
● Application code
● Runtime environment
Platform as a Service
● Instance
● Queue
● Database
Infrastructure as a Service
● VPC, Network, Gateways, ...
● DNS
● CDN
{
{Infrastructure
Service(s)
Feeds data

28. Outputs

29. Data sources

30. Workflow

31. 31
Application
● Application code
● Runtime environment
Platform as a Service
● Instance
● Queue
● Database
Infrastructure as a Service
● VPC, Network, Gateways, ...
● DNS
● CDN
{
{Infrastructure
Service(s)
Feeds data

32. 32
IaaS workflow
Commit
Hook
Build
Deploy
...

33. 33
Application
● Application code
● Runtime environment
Platform as a Service
● Instance
● Queue
● Database
Infrastructure as a Service
● VPC, Network, Gateways, ...
● DNS
● CDN
{
{Infrastructure
Service(s)
Feeds data

34. 34
PaaS workflow
Commit
Hook
Build
Deploy
AMI-ID
Apply

35. 35
Build

36. 36
Deploy

37. Why?

38. 38
Automating / Packer worflowWhat’s
your
IP?
What’s the
subnet of
Apollo 11?
Could you
whitelist my
service?

41. 41
10.100.0.0/24
172.26.0.0/16
10.0.0.0/8192.168.0.0/24
10.255.255
10.100.0.0/24

42. 42
10.100.0.0/24
172.26.0.0/16
10.0.0.0/8192.168.0.0/24
10.255.255
10.100.0.0/24
Let’s
have a
peering
No.

43. Granularity = faster, safer deploy
Centralisation = control, predictability

44. 44
CDNasCod
Mon
No! I will
apply now
I will apply
now

45. 45
Infra as Code
DNSasCode
CDNasCode
Monitorin
as Co

46. 46
Infra as Code
DNSasCode
CDNasCode
Garlic as
Code
Platform as Code

47. Thank you!
Q & A?
#weAreHiring