Project

tfctl

0.03
No release in over a year
tfctlscalefactory/tfctlHomepageDocumentationSource CodeBug Tracker
Terraform wrapper for managing multi-account AWS infrastructures
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Popularity
Downloads
53,657
Stars
45
Forks
11
Watchers
9
 Releases
Current version
1.6.1
Total releases
14
First release
2019-11-08
Latest release
2022-08-25
 Issues
Open Issues
1
Closed Issues
10
Total Issues
11
Issue Closure Rate
90%
 Pull Requests
Open Pull Requests
0
Closed Pull Requests
5
Merged Pull Requests
29
Pull Request Acceptance Rate
85%
 Development
Primary Language
Ruby
Licenses
MIT
Average date of last 50 commits
2021-11-21
Reverse Dependencies
0

 Dependencies

Development

guard-rspec
~> 4.7
rspec
~> 3.9
rubocop
~> 1.3
rubocop-rspec
~> 2.2

Runtime

aws-sdk-organizations
~> 1.40
json_schemer
~> 0.2
parallel
~> 1.19
terminal-table
>= 1.8, < 4.0
 Project Readme

tfctl

Linter Tests Gem Version Terraform 0.12

  • Overview
  • Features
  • Requirements
  • Installation
  • Documentation
  • Running tfctl
  • Project status

Overview

tfctl is a small Terraform wrapper for working with multi-account AWS infrastructures where new accounts may be created dynamically and on-demand.

It discovers accounts by reading the AWS Organizations API, and can assign Terraform resources to multiple accounts based on the organization hierarchy. Resources can be assigned globally, based on organization unit (OU) or to individual accounts. It supports hierarchies of nested OUs, and helps keep your Terraform DRY.

The Scale Factory originally created tfctl to integrate Terraform with AWS Landing Zone and Control Tower but should work with most other ways of managing accounts in AWS Organizations.

Features

  • Discovers AWS accounts automatically.

  • Automatically generates Terraform account configuration.

  • Parallel execution across multiple accounts.

  • Hierarchical configuration based on AWS Organization units structure.

  • Supports per account configuration overrides for handling exceptions.

  • Supports nested organization units.

  • Terraform state tracking in S3 and locking in DynamoDB.

  • Account targeting by OU path regular expressions.

  • Automatic role assumption in target accounts.

  • Works with CI/CD pipelines.

Requirements

  • Terraform >= 0.12.29

  • Ruby >= 2.5

  • Accounts managed in AWS Organizations (by Landing Zone, Control Tower, some other means)

Installation

To install the latest release from RubyGems run:

gem install tfctl

Alternatively, you can build and install from this repo with:

make install

Running tfctl

You should run tfctl from the root of your project directory. It will generate Terraform configuration in .tfctl/ (add this to your .gitignore).

Anatomy of a tfctl command:

tfctl -c CONFIG_FILE TARGET_OPTIONS -- TERRAFORM_COMMAND

  • -c specifies which tfctl config file to use (defaults to tfctl.yaml in current working directory if not set)

  • TARGET_OPTIONS specifies which accounts to target. This could be an individual account, a group of accounts in an organizational unit or all accounts.

  • TERRAFORM_COMMAND will be passed to terraform along with any options. See Terraform commands for details.

📎
 You must have your AWS credentials configured before you run tfctl, or run it using an AWS credentials helper such as aws-vault.

Example commands

Show help:

tfctl -h

Show merged configuration:

tfctl -s

List all discovered accounts:

tfctl --all -l
💡
 This can be narrowed down using targeting options and is a good way to test what accounts match.

Run terraform init across all accounts:

tfctl --all -- init

Plan Terraform across all accounts in the test OU:

tfctl -o test -- plan

Plan Terraform in live accounts, assuming that live is a child OU in multiple organization units:

tfctl -o '.*/live' -- plan

Run a plan for an individual account:

tfctl -a example-account - plan

Apply Terraform changes across all accounts:

tfctl --all -- apply

Destroy Terraform-managed resources in all the test OU accounts:

tfctl -o test -- destroy -auto-approve

Don’t buffer the output:

tfctl -a example-account -u -- plan

This will show output in real time. Usually output is buffered and displayed after the Terraform command finishes, to make it more readable when running across multiple accounts in parallel.

Project status

tfctl is an open source project published by The Scale Factory.

We currently consider this project to be maintained but we don’t actively develop new features. We keep it security patched and ready for use in production environments.

We’ll take a look at any issues or PRs you open and get back to you as soon as we can. We don’t offer any formal SLA, but we’ll be checking on this project periodically.

If your issue is urgent, you can flag it as such, and we’ll attempt to triage appropriately, but we have paying customers who also have demands on our time. If your business depends on this project and you have an urgent problem, then you can talk to our sales team about paying us to support you.