DEVOURED
AWS Control Tower Proactive Controls for Terraform: A Proof of Concept
An experiment shows how Terraform's Cloud Control provider can trigger AWS Control Tower's proactive controls, which are natively designed for CloudFormation Hooks.
What: AWS Control Tower's proactive controls are implemented as CloudFormation Hooks that evaluate resource creation via the Cloud Control API. This proof-of-concept explores using Terraform's Cloud Control provider to invoke these controls, bridging a native incompatibility between Terraform workflows and AWS's CloudFormation-centric governance features.
Why it matters: This highlights the ongoing challenge of integrating AWS's native governance and security features, which are often built around CloudFormation, with popular third-party Infrastructure-as-Code tools like Terraform, prompting engineers to seek creative workarounds.
Decoder
- AWS Control Tower: An AWS service that provides a simplified way to set up and govern a secure, multi-account AWS environment.
- Proactive controls: Governance rules in AWS Control Tower that prevent non-compliant resources from being provisioned, enforced by CloudFormation Hooks.
- CloudFormation Hooks: Capabilities within AWS CloudFormation that allow custom logic to be executed before or after stack operations (create, update, delete) to validate or mutate resources.
- Cloud Control API: A unified API by AWS for managing resources across many AWS services, simplifying programmatic resource management.
Original article
AWS Control Tower proactive controls are CloudFormation Hooks that evaluate resources at creation time via the Cloud Control API, but they are not natively compatible with Terraform workflows. An experiment explores whether Terraform's Cloud Control provider can trigger these controls to bridge the gap.
Explore all 49 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi