Gruntwork Blog

We (http://gruntwork.io) are still establishing best practices around managing multiple AWS accounts, but so far having a single "admin" account where all IAM Users are managed seems like a best practice. You can then implement a nifty dropdown that allows IAM Users to easily switch accounts. [1] I'm not sure about how IAM Groups fits into this. For IAM Roles, we use Infrastructure-as-Code (Terraform) to create all those anyway, so I still prefer to create those in the AWS account that contains the resources to which they apply. [1] https://aws.amazon.com/blogs/security/enable-a-new-feature-in-the-aws-…

Gruntwork (http://www.gruntwork.io/) | Anywhere | DevOps | Contractor At Gruntwork, we offer DevOps as a Service. Our mission is to make it an order of magnitude easier to understand, develop, and deploy software. The first step in that direction is to take the thousands of hours we’ve spent building infrastructure and to condense all that experience and code into pre-assembled Infrastructure Packages. Each Infrastructure Package is a best-practices definition of a single piece of infrastructure (e.g. a Docker cluster or a relational database) that is reusable, battle-tested, documented, configurable, and supported (read more here: https://blog.gruntwork.io/gruntwork-infrastructure-packages-7434dc77d0… In other words, we're like a DevOps team that has already built everything you need. We give customers 100% of the source code for our packages and we offer a subscription that includes support, package updates, access to the Gruntwork community, security alerts, proactive maintenance, and more. We are looking for Full Stack Engineers, DevOps Engineers, and AWS experts. We make heavy use of Terraform, Docker, Packer, AWS, and Go. Currently, we have one project where we're looking for experts in the Windows environment (e.g. IIS, SQL Server, Active Directory) and one where we are looking for an expert on Kubernetes. We are a completely distributed company, so location doesn't matter, and the work is 100% remote. If you're interested, email us at [email protected].

Gruntwork (https://gruntwork.io) | Golang Engineer - Open Source | Worldwide Remote | Contract Gruntwork is hiring a senior Golang engineer to focus specifically on Open Source projects, primarily OpenTofu but also Terragrunt and other tools. Work collaboratively with the open source community to design and implement innovative new features at the frontier of devops tooling. Help maintain and improve the quality of our codebase, infrastructure, and documentation. Review and provide feedback on pull requests from the community and team members. https://jobs.ashbyhq.com/Gruntwork/a6b852e6-2ab6-4eaf-b643-37b080633f1…

Ohad here, co-founder of env0, one of the main supporters of opentf I think Gruntwork's blog explains this the best - https://blog.gruntwork.io/the-future-of-terraform-must-be-open-ab0b9ba…

Like others have said, your infra might itself be the product. Look at https://gruntwork.io as possible inspiration. They’ve made a lucrative business by selling infra scripts that others can use. And their subscription model means they keep the scripts up to date.

Your description of Ansible makes me think of the Apache Ant build system. James Duncan Davidson's post mortem was illuminating. He never intended to create executable XML scripting. Am noob. Have done a wee bit of CloudFormation, Docker, k8s. And once completed a Terraform howto. I've never touched Ansible, Chef, Puppet, etc. I'd love a feature comparison matrix. Or maybe a decision flowchart on how to choose which tool for which job. -- Update: This comparison was linked upthread. It's pretty good. https://blog.gruntwork.io/why-we-use-terraform-and-not-chef-puppet-ans…

Gruntwork has a lot of Open Source tooling around AWS and their new guides are pretty great for some of what you're mentioning https://gruntwork.io/guides/ I am in no way affiliated with them other than being a customer

I've written code like that for clients (and specifically executed a transition from bare metal+shell scripts to EKS for a "generic backend" module once), but I can't publish any of it for unfortunate obvious reasons. But FWIW I think it's inherent to IaC to involve a lot of copy-pasta, sometimes your best abstraction will just lead to shifting the copy-pasta from code to call-sites, which tends to be more maintainable but still. What I can recommend is to treat your modules for what they are: Public library functions. Meaning common sense advice for those applies: - Approach writing modules by actually designing an API for it. Don't treat it as a folder to dump resources in. - Make your API as small as you can get away with. - Its variables and outputs should be, whenever possible, describe a generic black box that could have its internals swapped. - Make modules composable where you can. Being able to pass around entire module instances in variables because they have clean, stable APIs is very nice. - Accept some things will inevitably leak but put in the effort to minimize them. This blog post and the book from the authors (Terraform Up & Running) has some good ideas that got me started with the basics, but there's not much written with regards to more involved usecases: https://blog.gruntwork.io/how-to-create-reusable-infrastructure-with-t…

Take a look at this talk - it explains what both tools do and how they can work together well: https://www.hashicorp.com/resources/ansible-terraform-better-together/ TLDW; You can do resource management (e.g. creating EC2 instances in AWS) and deployment (e.g. installing packages on an instance) through both Terraform and Ansible. Terraform is best used for resource management - the documentation states using the "provisioning"/deployment function is a last resort. Ansible is great at deploying packages but less so at resource management for the reasons you'll see in the other comments. Either use them together for what they're good at, or use Terraform to do resource management and other techniques (such as prebuilt images) for deployment: https://www.terraform.io/docs/provisioners/index.html Also useful: https://blog.gruntwork.io/why-we-use-terraform-and-not-chef-puppet-ans…

Yes, that's mostly covered by the companies sponsoring OpenTofu's development: Spacelift[0] (I work here), env0[1], Scalr[2], Harness[3], Gruntworks[4]. [0]: https://spacelift.io [1]: https://www.env0.com [2]: https://www.scalr.com [3]: https://www.harness.io [4]: https://gruntwork.io

Perhaps you’d like the Gruntwork reference architecture diagram made with CloudCraft: https://gruntwork.io/reference-architecture/

I have limited experience with Ansible, but afaik calling it declarative when compared to Terraform is a stretch [1] [1] https://blog.gruntwork.io/why-we-use-terraform-and-not-chef-puppet-ans…

Well, judging from the release notes, with for-loops you are now one step closer to a real programming language. Looks like the beginning of the end of the "declarative" paradigma which keeps people running their heads against the wall like this https://blog.gruntwork.io/terraform-tips-tricks-loops-if-statements-an…

Here is their full checklist: https://www.gruntwork.io/devops-checklist/

The first sentence links to gruntwork.io[0] where 29 different tools/projects are listed. Seems to be provisioning and configuration for existing services (most of them Amazon, from the looks of it). There are several Hashicorp projects as well, including Vault, Nomad. [0]: https://gruntwork.io/infrastructure-as-code-library/

We just released Terragrunt 1.0. Notable updates: - Terragrunt Stacks. A modern way to define higher-level infrastructure patterns, reduce boilerplate, and manage large estates without losing independently deployable units. - Streamlined CLI. A less verbose, more consistent; `run` replaces `run-all`, and new commands `exec`, `backend`, `find`, and `list`. - Filters `--filter`. One targeting/query system to replace several older targeting flags, plus new capabilities for selecting units/stacks. - Performance improvements, especially if you’re upgrading from older Terragrunt versions, and automatic shared provider cache when using OpenTofu ≥ 1.10. - And an explicit backwards compatibility guarantee. Gruntwork is making a formal commitment to backwards compatibility for Terragrunt across the 1.x series. Read the full announcement https://www.gruntwork.io/blog/terragrunt-1-0-released Questions/feedback welcome.

Also IBM [0], possibly AWS with Proton [1], GitLab [2], Harness [3], Gruntwork [4] and probably a dozen other smaller players. [0] https://www.ibm.com/cloud/schematics [1] https://aws.amazon.com/about-aws/whats-new/2022/03/aws-proton-terrafor… [2] https://docs.gitlab.com/ee/user/infrastructure/iac/ [3] https://medium.com/@steve.burton/harness-introduces-aws-cloudformation… [4] https://gruntwork.io/pipelines/