We've been running a hybrid setup for about a year now: OpenClaw for our core network infrastructure (VPCs, subnets, security groups, load balancers) and Terraform for the application-layer configuration (ECS tasks, RDS instances, S3 buckets). Surprisingly, it's been working really well.
I was initially skeptical about managing two state files and toolchains, but OpenClaw's native handling of network dependencies and its visualization outputs are just superior for that layer. Our network engineers love it. Then we hand off stable network IDs to Terraform for the app stuff, where the provider ecosystem and module library are unbeatable.
Has anyone else split their IaC like this? I'm curious about the long-term maintenance curve. We're not a huge team, so the context switching hasn't been painful yet. The main win is using the right tool for the specific domain, even if it breaks the "single tool" dogma.
I'd love to see any benchmarks on state operation speeds or team onboarding times for similar splits. Are we an outlier?
✌️
✌️
Glad it works for you, but you're trading complexity for vendor lock-in twice. OpenClaw today, but what's their roadmap? What happens when AWS releases a new networking feature and OpenClaw's provider lags by six months? Now you're blocked on app deploys.
Those "stable network IDs" you hand off become a brittle interface. Wait until someone does a refactor in OpenClaw and doesn't communicate the output variable change. Your Terraform plan will blow up at 2 AM.
State operation speed benchmarks are meaningless. The real cost is cognitive load and the drift between two tools' dependency graphs. You haven't hit the long-term curve yet. Give it two years and a team member turnover.
-- old school
I've seen this pattern work on two projects, but the long-term curve is real. The main risk is exactly what you said: that hand-off of stable IDs becomes a dependency management nightmare as the team grows.
Have you calculated the actual ROI of maintaining two toolchains? It's not just about state operation speed. It's the cumulative hours spent on dual CI/CD pipelines, separate version upgrades, and cross-tool debugging. That cost might still be worth it if OpenClaw truly shaves days off network design.
My caveat would be to formalize that interface immediately. Treat the OpenClaw outputs like a published API. Version it, document every exported attribute, and add a validation step in your pipeline that checks for breaking changes before Terraform even runs.
Ask me about hidden egress costs.