Terraform : manage specificities over each environment

Question

I have 3 environments to manage via Terraform: dev, staging, prod.

An example of use case is below:

• create a "common" service account for each environment (sa-xxx@dev + sa-xxx@staging + sa-xxx@prod)
• create a "dev-specific" role for this sa-xxx@dev SA
• create a "staging-specific" role for this sa-xxx@staging SA
• create a "prod-specific" role for this sa-xxx@prod SA

How can I easily manage common & specific resources for each environment?

Terraform is very simple if all environments are equals, but for specificities it looks more complicated. The goal is have a structural way to manage it, and then to avoid:

• code duplication in 3 distinct folders
• "count" conditions in each tf resource definition

It should be possible for Terraform to look into current root folder UNION dev/staging/prod folder (depending on the environment).

The need is very simple but implementation seems so difficult.

Thanks for help ! :)

Answer 1

This is a pretty broad question and so it's hard to answer specifically, but one general answer to this question is to make use of shared modules as a means for sharing code between your separate configurations.

The Module Composition guide describes some different patterns that might help you in your goal. The idea would be to make each of your configurations share modules wherever it makes sense for them to do so but to also potentially use different modules -- or the same modules but with different relationships/cardinalities -- so that your configurations can represent both what is the same and what is different between each of them.

Answer 2

One way would be to put shared resources in a common configuration managed in a remote state. Then in other configurations, you can refer to the shared, remote state using terraform_remote_state data source.