Скачать или смотреть 🏘️ 🏠 How to isolate Terraform state files and mitigate impact between environments

Learn how to isolate Terraform state files and mitigate impact between environments

While we saw how remote backend could be a potential answer to the challenges we could encounter when working with a team, one challenge remains: isolation of environments.

Indeed, as we can be tempted to define all our infrastructures in a single Terraform file or single set of Terraform files in one folder, there are no clear isolation between environments.
So, for example, running a Terraform Apply intended only for production’s resources , can affect another staging’s resources, including accidentally deleting resources in this environment.

These are the 3 main mechanisms we implemented on Brainboard, to make it less likely for an environment to have an impact on another one.

1️⃣ Isolation by projects, environments and architectures.

By doing so, we can store our Terraform state in multiple, separate folders.
We can use separate Terraform folders for each environment and for each architecture.
When we run the Terraform plan, we can observe that our infrastructure will be in the staging environment.

2️⃣ Isolation by having different backend for each environment.

One drawback of the previous method is that all the state files are stored in the same backend. Either the S3 or the Blob Storage.
We can specify the remote backend we want to use for which environments and architectures we’re working on.

3️⃣ Isolation by setting-up cloud credentials.

One way to make it more transparent for which projects, environments or architectures we’re deploying to is to use separate authentication mechanisms when we set up our credentials.

When another colleague or we try to deploy the infrastructure in an environment in which the credentials have not been selected, Brainboard will automatically detect it and warn us that the intended operation can not proceed.

#terraform #cloud #iac #aws #azure #gcp #100daysofcloud #levelup #solutionsarchitect #devops