Hi everyone. I've been working with Google Workspace and various SaaS migrations for a while, but I'm relatively new to the IaC space. I've been using Terraform for about a year and recently started a project with AWS CDK (TypeScript).
Here’s my observation: one of the big complaints about Terraform is that community modules can be black boxes. You’re never quite sure what resources they’re creating or what hidden defaults they have unless you dig deep into the source. I totally get that.
But after using CDK for a few months, I'm finding its "constructs" to be just as opaque, if not more so in some ways. At least with a Terraform module, you can usually see the static resource definitions. With a CDK construct, especially from third-party libraries, you're dealing with layers of abstraction where the final CloudFormation output isn't obvious.
A few pain points I've hit:
* A third-party construct for a "standard" API setup created way more resources (Log Groups, extra IAM roles) than I expected. It was efficient, but debugging a permissions issue was tricky.
* Tracing through the L2/L3 construct inheritance to find where a specific property is actually set feels like detective work.
* The "escape hatches" are powerful, but needing to use them feels like admitting the abstraction failed.
My question is: for those who've migrated from Terraform to CDK (or use both), do you feel the same? Is the opacity a fair trade-off for the developer experience and flexibility?
I'm trying to decide if digging deeper into CDK is worth it for my team's productivity, or if we're just swapping one type of complexity for another.
Migration is never smooth.