tf vs cdk(cfn) (vs pulumi vs cdktf)

[jonny-rimek]

cdk

• fixes state on it's own (tries to)
• very good ide support, e.g. enums for possible ec2 instance types
• opinionated l2 constructs authored and maintained by AWS
• built in fixes for cfn shortcomings +- possible to manage 3rd party resources but no community
• relies on historically slow cfn support
• can use cfn community projects such as cfn-nag
• nice "local" dev exp, with watcher and outside of cfn deployments for lambdas +- drift detection?!

tf

• secrets are exposed in the tf state files!!!
• stops after error, does not fix state!!!
• 1000s of community authored providers
• very mature testing library (terratest)
• fixes poor'ish IDE support
• faster feature parity
• reading remote state

cdktf

• will allow using cdk constructs!!! https://www.terraform.io/cdktf/create-and-deploy/aws-adapter
• fixes poor'ish IDE support
• does not fix inherent tf flaws like secrets in state or error state
• more idiomatic package management compared to tf
• allows mix between tf and cdktf
• can convert tf modules to cdktf
• still need to use tf functions for runtime values

pulumi

• very few aws l2 constructs
• none for other clouds
• smaller community compared to tf ? does it fix broken state? ? drift detection ?

[jonny-rimek]

https://acloudguru.com/blog/engineering/cloudformation-terraform-or-cdk-guide-to-iac-on-aws