I currently use Terraform workspaces to configure different environments like dev, test, prod, and my code works fine. And I believe I can use workspaces to configure different regions as well.
However, I think Terraform modules can do the same thing, right?
If that's so, when should I use workspaces and when should I use modules? Or they are doing a similar thing in different ways?
I think a key difference between Terraform Modules and Workspaces is that modules can be inherited and used by other modules and configurations. Terraform Workspaces are intended to be a collection of configurations that represent a single environment, whereas Modules are components that can be utilized by one or more modules/configurations. I think you could use Modules in a similar way to how you are using Workspaces, but you would be contradicting the intent of the Modules.
For example, say that you want to create a base configuration file for all your company's EC2 instances that allows traffic over SSH. You would create a module that spins up a VM, modifies your firewall to allow SSH, and any other configuration settings that you would want all of your instances to have. You would then have every VM Terraform config inherit this file. This would minimize the amount of code that you would have to write and allow for any changes that you would want across all of your TF configs to be made in one central module.
Terraform modules are a way to encapsulate reusable business logic in order to be DRY. For example, you might use a module to define a jenkins setup, then invoke that module every time you want a jenkins server. In other words, you can instantiate modules as many times as you need them to achieve the same outcome.
On the other hand, Terraform workspaces are a way to isolate terraform state between environments. For example, you don't want to mingle state between a production and staging environments.
In practice, we highly recommend writing modules for everything. This is why we have over 100+ modules. Writing modules is like writing "functions" in other languages. Generally, it's considered a bad practice to stick all logic in a single function or scope; modules help us avoid that.
Workspaces are nice in principle, but in practice we recommend to share nothing between production and staging environments, including terraform state. Workspaces violate this principle. Thus we architect things so that production state remains in the production account and staging state in the staging account. We accomplish this with our terraform-aws-tfstate-backend module.
———
For the record, “we” refers to Cloud Posse, a DevOps professional services company. I am the founder. The views expressed are our own and may not represent the views of the community at large. :)
