I'm currently migrating my infrastructure as code (IaC) from generated CloudFormation templates to Terraform, and I'm about 80% finished. I manage five environments across four AWS regions and employ an A/B deployment strategy. Given this complexity, I'm wondering if I should refactor my existing setup to use Terragrunt or just stay with vanilla Terraform, especially considering the various environment permutations (like env/region/A|B). Additionally, I want to know if it's a common practice to keep module definitions in separate repositories from the live environment repositories. I think using modules with specific revisions could be beneficial for avoiding issues when updating modules without breaking existing environments. Right now, my IaC repositories include separate repos for each app (A, B, C), a static repo for non-A/B resources like VPCs, and an account setup repo for one-time resources and scripts. Should we have separate repos for modules and live environments?
6 Answers
You could keep module definitions and live infrastructure in a single monorepo. This way, your module instantiations can reference a specific commit SHA or GitHub release version, which could be really useful for version control.
Separating your module and deployment repositories is definitely a best practice, especially if your environments are similar. I recently set up eight environments using this approach, and while it took a fair amount of time, it was well worth it. Using Terragrunt can help reduce duplication and make management easier, allowing you to apply changes across environments with just one command.
You probably don't need Terragrunt unless you're dealing with multiple apply waves. For single-wave deployments, vanilla Terraform should suffice. But if you find your needs expanding, Terragrunt can really simplify managing complex multi-environment setups. Just a heads-up, many folks think it's overkill, but it has its powers!
True! It depends, but sometimes managing dependencies can get tricky.
Your Terraform setup sounds solid! I always recommend keeping shared resources in a separate repo and as much IAC in the application's repo. When you have more than two or three environments, Terragrunt starts to look more appealing.
I’d recommend sticking to vanilla Terraform as much as possible. But if you run into issues like dependency conflicts or need to deploy the same code across different accounts, consider looking into alternatives like Terraspace instead of Terragrunt!
Just curious, why do some people seem to dislike Terragrunt? I've only worked with it!
It's definitely an interesting debate—I'd love to know the pros and cons, too!
With five different environments, going complicated with Terragrunt might not be necessary. It can get complex fast, and sometimes simpler setups are easier to manage.
That’s interesting! But is it worth it to keep everything in sync across environments?