Massive Terraform Imports and Why you should Avoid Building Monoliths
summary
A platform team migrates a monolithic Terraform module that granted per-service-account IAM members and hits GCP's 1,500 assignment limit, forcing a migration to group-based grants. Recovery uses Terraform with the Google Workspace provider, Sentinel to extract planned addresses, a data-only workspace to read member IDs, a Python script to generate about 1800 imports, and manual runs that total roughly 24 hours. A quick flag and a cleanup remove ~300 legacy members but full migration requires blocking the workspace.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:52Who am I
- 1:30Why monoliths
- 8:32Mitigation
- 10:30Google Workspace
- 11:22Imports
- 12:23Sentinel
- 13:40Expected Output
- 14:24Sentinel Policy
- 15:03Terraform Data Workspace
- 16:45Python Solution
- 19:11Conclusion
related talks
28mSurviving migration madness - Humana's move from Terraform Enterprise to Terraform Cloud
31mTerraform Structure & Enablement
25mManaging Terraform Enterprise With 2000+ Workspaces at Discover Financial
55mSelf-service infrastructure is no longer a dream
30mBeating the competition through faster time to market
44mHashiCorp Global 2022 Keynote Day 2
08mLightning Talk: No Portal? No Problem! How We Scaled Our Platform With Just Terr...
22mNetwork Automation on Terraform Cloud With CTS