https://cloudposse.com logo
Join Slack
Powered by
I found some interesting design differences betwee...
# atmos
p
I found some interesting design differences between my own GCP components vs. Cloud Posse AWS components. I designed my GCP components to always take explicit 
var.project_id
, this concept of account_map is quite confusing. 😃 Especially when tofu allows to use variables within provider blocks nowadays.
Why not just take in variable like 
assume_role
to the component directly? Why have component look up things from outside?
e
There are actually a lot of reasons not to do a role assumption inside of Terraform
Chief among them is that when Terraform runs a plan using that role and if you want to use a different role during apply, that role is baked into the Terraform plan file itself
The other reason is that moving to Atmos Auth, you have a lot of other benefits in terms of how you manage authentication.
Atmos Auth supports OIDC and Single Sign-On natively
So yes, you're entirely right about 
account-map
; We've wanted to move away from this for a very long time. Introducing 
atmos auth
was what enabled us to do so.
🙌 1
2 Views
Open in Slack
PreviousNext
Powered by