# Exercise 2: Choose the Right IaC Tool for Four Teams

For each team, recommend a tool (Terraform/OpenTofu, CloudFormation, AWS CDK, Pulumi, Ansible, Helm/Kustomize, or a combination) and justify it with the criteria from `tf_iac_fundamentals_theory.md` sections 2–4: scope (clouds/SaaS), language, state management, team skills, and provisioning vs configuration.

## Team A — Platform team, multi-cloud

Runs workloads on AWS and GCP, manages Cloudflare DNS, GitHub repositories and teams, PagerDuty schedules and Datadog monitors. 6 engineers comfortable with ops, not strong programmers.

## Team B — AWS-only product team

A TypeScript-heavy team of 12 building serverless apps (Lambda, API Gateway, DynamoDB, Step Functions). They want to share abstractions ("a standard API with auth, logging and alarms") as code libraries and unit-test them.

## Team C — Legacy on-prem servers

40 long-lived Linux VMs in a data center running Java apps; they need packages installed, config files templated, services restarted, OS patches applied. No cloud APIs.

## Team D — Kubernetes application team

Deploys 15 microservices to an existing EKS cluster; each service needs Deployments, Services, Ingress, HPA, ConfigMaps; environments differ only in replicas and image tags.

## Deliverables

1. Recommendation + justification for each team (4–6 sentences).
2. For Team A, explain how state is stored and locked, and what happens if two engineers apply at the same time.
3. For Team B, compare CDK vs Terraform in one table (5 rows).
4. For Team C, explain why "immutable infrastructure" would change the tool choice over time.
5. Identify a team where **two** tools together make sense, and draw the boundary between them.

## Requirements Checklist

- [ ] A → Terraform/OpenTofu (provider ecosystem covers AWS, GCP, Cloudflare, GitHub, PagerDuty, Datadog; HCL approachable), with a remote backend + locking.
- [ ] B → AWS CDK (TypeScript constructs, unit tests, AWS-only) — or Pulumi TS — with a clear comparison table.
- [ ] C → Ansible for configuration management (no cloud provisioning API), noting that moving to images/containers reduces the need.
- [ ] D → Helm or Kustomize (with GitOps via Argo CD/Flux), while the cluster itself is provisioned with Terraform.
- [ ] A two-tool boundary is described (e.g. Terraform for cluster/infra + Helm/Argo CD for in-cluster apps).