Use Terraform for changes to what your infrastructure should permanently look like. Use a self-service app for actions someone needs performed now, such as granting temporary access, whitelisting an IP or cleaning up a resource. Most teams run both side by side.
Teams that get good at Terraform tend to reach for it for everything. That works until someone needs a vendor IP allowed for two days and the answer is a pull request, a plan, a review and an apply. The person asking does not know Terraform, so they file a ticket, and an engineer writes the pull request for them.
One question sorts it out
The first belongs in Terraform. The second is an operational request, and pushing it through infrastructure as code adds ceremony without adding much safety.
| Belongs in Terraform | Better as a self-service app |
|---|---|
| A new network or database | Allowing an IP for two days |
| Changing an instance size for good | Restarting a service |
| A standard alert on every service | Temporary access for a contractor |
| Tagging rules for all resources | Deleting snapshots older than 90 days |
Does an app skip your review process?
It should not, and it does not have to. In DevAutOps the person who builds and approves an app is separate from the people allowed to run it. The review happens once, when the app is built. After that every run is checked against a role and written to the audit log, which is often a clearer record than a merged pull request with a vague title.
What about drift?
This is the fair objection. If an app changes something Terraform manages, the next plan will try to undo it. The answer is to keep each tool on its own side of the line: let apps act on things Terraform does not own, such as temporary rules kept in their own rule set, or have the app open a pull request instead of changing the resource directly.
Questions
Is DevAutOps a replacement for Terraform?
No. Terraform defines and maintains infrastructure state. DevAutOps handles the operational requests people make against that infrastructure once it exists.
How do I decide whether a change belongs in Terraform?
Ask whether it describes how the infrastructure should permanently look (Terraform) or an action someone needs performed now (a self-service app).
Will a self-service app cause drift with Terraform?
Only if both manage the same resource. Keep apps on resources Terraform does not own, or have the app open a pull request instead of making the change directly.