In my first post here, I wrote about starting my DevOps journey.
Since then, I have finished my capstone project and wrapped up the program.
This project is what I decided to build first on my own after the boot camp ended.
One question had been bugging me since early in terraform is; if everything lives in one state file, doesn’t that mean one small mistake could break the whole thing? So I built a finance tracker app to test the answer on something real. And it turns out that you can avoid it. But how? You will have to split your state.
My idea
Instead of one terraform project managing everything, I split mine into three: Network, Data and App. Each one has it own state file and get applied separately.
So a mistake in the app layer can’t touch the database when I am working inside app, terraform doesn't even know the database exists. It’s not even in the state file at all.
Network barely changes. Data changes rarely but is expensive to lose. App changes constantly.
Splitting along those lines means my day to day work doesn’t share the same of impact as my database.
The only problem I didn’t see coming.
I wanted my database to only accept connections from my app server.
I thought it would be easy, just to link the database to the app server’s security group.
But the problem is the order. The network comes first, then the database and then the app.
When I was setting up the database, the app server did not exist yet, so I did put in its ID reference.
So instead, I allowed the whole VPC to access the database. Its less secure but it works just fine for this project and that’s an okay trade off
A few other things work mentioning.
I did not put the database password in the normal config file but a separate file .gitignore
My SSH rule updated itself. I did not hardcode my IP because it changes. Terraform automatically grabs my current IP every time I run it.
Every module document itself. Terraform doc reads the code and makes a table of variables and outputs for me.
I did not include staging/dev/prod environment.
The whole goal was to split the terraform state and it worked. Now if I run apply on the app, it cant accidently break database, not because I am careful but because the setup physically prevents it.
Top comments (0)