In the cloud environment, the tools "AWS CloudFormation" or "Terraform", for example, are used to implement IaC. But which of these IaC tools should be chosen in the IT project environment?
What is "AWS CloudFormation"?
AWS CloudFormation is the official Infrastructure as Code (IaC) solution from Amazon Web Services (AWS).
It orchestrates and automates the creation, updating and deletion of AWS resources based on templates.
This enables documentation, versioning and storage of the infrastructure in the form of text files.
The main components of CloudFormation are:
- Templates: declarative scripts that define what the infrastructure should look like
- Stacks: Instantiations of a template/template
- StackSets: Management of stacks across accounts and regions
The templates can be created with the AWS CloudFormation Designer and used to create a stack. Once a stack has been created, it can then be managed, e.g. updated or deleted, via the AWS console.
What is "Terraform"?
Terraform is the Infrastructure as Code (IaC) solution from HashiCorp.
It automates the creation and management of cloud resources from different cloud providers.
The main components of Terraform are
- Configuration files (.tf file): declarative scripts that contain the configuration information for the cloud resources to be created (variables can be outsourced to other configuration files)
- a status file (terraform.tfstate file): current version of the infrastructure
The configurations can be applied or executed using various commands:
- (optional) terraform refresh: Query current infrastructure
- (optional) terraform plan: Creation of a plan based on the configuration files including a list of the steps to be carried out
- terraform apply: Execution of the plan and implementation of the changes (creation/modification of resources)
- terraform destroy: Deletion of resources or the entire infrastructure
What are the advantages or disadvantages of AWS CloudFormation and Terraform in comparison?
Multi-cloud support:
AWS CloudFormation specializes in the orchestration of AWS resources, but also enables the integration of other cloud providers. Terraform is cloud-neutral and supports a large number of cloud providers such as Google Cloud or Azure.
License and support offer:
AWS CloudFormation can be used free of charge within AWS. AWS support is provided depending on the support plan booked. Terraform is a pure open source IaC tool. Support is also offered by HashiCorp, but without support SLAs (service level agreements).
Integration of services and functions:
Both AWS CloudFormation and Terraform are aimed at the rapid integration of new AWS services and functions. However, the more flexible and modular architecture of Terraform can sometimes enable faster integration of new functions. As Terraform is an open source tool, it also has access to a large developer community that can work together on the integration. Nevertheless, AWS CloudFormation is developed and maintained by AWS itself, which leads to a more comprehensive and consistent integration.
Configuration / programming:
AWS CloudFormation can be controlled via a user interface or CLI. The IT infrastructure is configured in AWS CloudFormation using JSON and YAML-based templates. Code analysis is supported via CloudFormation Linter. If common programming languages are to be used, IaC can also be defined via the "AWS Cloud Development Kit" (AWS CDK).
Terraform is a purely CLI-based tool. The Terraform templates are based on the "Hashicorp Configuration Language" (HCL). This format is very similar to the JSON format. A code analysis of these templates can be carried out with TFLint or Chekov. Terraform also offers the option of using common programming languages via the IaC tool "Pulumi". The "Cloud Development Kit for Terraform" (CDKTF) tool, which was developed in cooperation between AWS and Terraform, can also be used.
Modules / Resources / Parameters:
AWS CloudFormation enables the configuration of modules and resources. Output parameters can be generated in AWS CloudFormation via cross-stack references and used as input parameters in other stacks. Several modules and resources are also available in Terraform, which can be combined as required. Template values can also be exported and used as output or input parameters for other resources.
Import of resources:
A number of defined resources can be imported via AWS CloudFormation. It is also possible to import existing resources via Terraform, even if they were not created via Terraform.
Status management:
The current status can be managed in AWS CloudFormation via stacks. This avoids contradictory changes and parallel processing. The status information from Terraform is stored in .tfstate files. By configuring "remote state", AWS ensures the storage of this status information, e.g. via an AWS S3 bucket. Parallel processing and execution of Terraform can be prevented by "remote locking".
Change management:
Changes can be made retrospectively in both AWS CloudFormation and Terraform.
With the help of change sets, AWS CloudFormation creates a change history of the last imported templates (target state) for the newly planned changes. Drift detection should be used to identify changes that were made outside of AWS CloudFormation. This can be used to identify changed resources that need to be updated in the stack template to ensure consistent operation.
Terraform uses "terraform plan" to determine all planned changes from the configuration file of the actual state of the infrastructure. This overview also automatically includes the changes that were not made via Terraform.
Error handling and rollback:
If an error occurs, AWS CloudFormation automatically rolls back to the last functional state. Such an automatic rollback is not possible in Terraform. The .tf file must be manually adapted and rolled out again to provide a functioning infrastructure.
AWS CloudFormation or Terraform?
If the IT project team already has experience with AWS CloudFormation or Terraform, it may be easier to use the IaC tool they are already familiar with.
In general, the choice of tool depends heavily on the specific requirements and restrictions of the IT project.
If, for example, the target infrastructure and thus its resources and functionalities are to be located primarily in the AWS ecosystem, AWS CloudFormation is the better choice. If, on the other hand, resources are to be orchestrated for several cloud providers, Terraform should be used.
Sources:
https://aws.amazon.com/de/cloudformation/
https://developer.hashicorp.com/terraform/cli
https://cloudonaut.io/cloudformation-vs-terraform/
https://www.toptal.com/terraform/terraform-vs-cloudformation
