terraform-provider-aws

This is really up to the writer of the provider (very often the service itself) to have the provider code correctly model how the service works. It very often doesn't and allows you to plan error-free what will fail during apply. It's not an API issue but a terraform provider issue having missing or incomplete code (i.e. https://github.com/hashicorp/terraform-provider-aws )

sometimes i think shipping source + compiler would be faster... the other day i was wondering why the terraform aws provider binary was now around 800MB compiled https://github.com/hashicorp/terraform-provider-aws/issues/3...

This is usually down to provider implementation which switching the core won't help. The provider controls HTTP calls and errors against the relevant service API. Here are the retries in the provider code https://github.com/hashicorp/terraform-provider-aws/blob/mai... It's hard coded to "certificateCrossServicePropagationTimeout" which is 20 minutes here https://github.com/hashicorp/terraform-provider-aws/blob/mai...

https://github.com/hashicorp/terraform-provider-aws/issues/3... The size is what you get when you add every single AWS Go client into one binary. Each service client like 1-2MB. But when you have 200 services....

I tried to setup an IPv6-only VPC last month and ran into lots of edge cases. For example, Terraform's aws provider doesn't support the http_protocol_ipv6 metadata option for EC2 instances, you can only set it in a launch template. It's a two year old issue: https://github.com/hashicorp/terraform-provider-aws/issues/2... I'm glad to see AWS driving people towards IPv6, but the tooling and documentation need to get a lot better.

> We're coming up on 10000 resources in our main Terraform repository and while there is definitely some friction, it's overall much better than having to hit the cloud API's to gather each of those states which would probably take at least an order of magnitude longer. I don't think that's necessary true. Most cloud API's actually can return hundreds of records with 1 API calls, e.g. https://docs.aws.amazon.com/elasticloadbalancing/latest/APIR... has a maximum page size of 400. If I manage the cloud resources via some custom tools and/or with some ansible-fu, I can decide to batch the API calls when it makes sense. With terraform, it is not possible to do so (https://github.com/hashicorp/terraform-plugin-sdk/issues/66, https://github.com/hashicorp/terraform-provider-aws/issues/2...).

Terraform as a language is a bit clunky and feels not quite complete. For example, to accomplish if/else logic, you have to hack something like: `count = var.is_foo ? 1 : 0` More than the language syntax, getting any response from the hashicorp team on their official providers is like rolling the dice. If your bug or feature pr is a bit on the fringes and not in their sights, it can sit for months/years without traction or even a non-automated response. With just the aws provider, there are over 3000 issues and nearly 400 open PRs. That team is understaffed or mismanaged. It has gotten marginally better over the last year or so, but generally speaking, Hashicorp doesn’t seem to care while they’re pouring all efforts into their own cloud. 1. https://github.com/hashicorp/terraform-provider-aws/issues/1... 2. https://github.com/hashicorp/te

Doing a very quick search [1] on the aws provider github repo, produces `92` open, and `306` closed issues with various bugs in the provider. I agree that most of them might not count as creating serious problems, but I as well have been using it quite extensively and can definitely remember cases where I have had to manually deal with corrupted state in various ways. I'm not sure which part of my comment was "FUD" - I never said that you shouldn't use terraform, I was pointing out that issues exist, always. I think of it as the nature of the work we're doing (I say we, as I imagine you are also in the SWE field based on your comments). Show me any piece of software without bugs, especially as complex as a tf provider, and I'm buying you whatever you want. [1] https://github.com/hashicorp/terraform-provider-aws/issues?q...

Terraform issue tracking support for architectures parameter: https://github.com/hashicorp/terraform-provider-aws/issues/2... There's a pull request that went up about 40 minutes prior to my comment. So it looks like it's coming, soon.

We have an internal provider that handles generation of IAM Roles and IAM users via an external API for various security reasons I may or may not agree with. The constant provider changes in 0.10 and upward were extremely painful. We actually ended up having several teams who so hopelessly fubared their tfstates trying to skip minor releases, we ended up having to take it away and put together a task force to do it ourselves across almost 200 repositories. I’m not sure what you mean by “all three major cloud providers rewrote their own APIs.” Azure[1][2], AWS[3], and Google[4] are all maintained by Hashicorp. In fact, if you peruse the issues you’ll often see PRs opened by employees of the respective providers trying to fix blocking issues and they often devolve into literal begging for Hashicorp to respond and at least tell them why som

Hey, I work on Semgrep. As a real world example, I just noticed today that Hashicorp uses a whole bunch of Semgrep rules on terraform-provider-aws[0]. I'd recommend reading the `message` keys to know what they intend to match, and then the `patterns` lists below to see how that's accomplished. Alternatively, we curate 1000+ community rules that you can look through as well.[1] [0]: https://github.com/hashicorp/terraform-provider-aws/blob/mai... [1]: https://semgrep.dev/r

The terraform AWS provider lags from time to time too. I remember waiting the best part of a year for API gateway websockets support. https://github.com/hashicorp/terraform-provider-aws/issues/7...

There's a long-running Terraform issue for the equivalent if you want to chime in: https://github.com/terraform-providers/terraform-provider-aw...

Terraform now has these identifiers: https://github.com/terraform-providers/terraform-provider-aw... Thanks to PatMyron at AWS, who apparently added this information to Terraform after seeing my mention above :-)