Terraform Stacks: MyCoCo's Landing Zone Dependencies Done Right

Terraform Stacks: MyCoCo’s Landing Zone Dependencies Done Right

MyCoCo’s platform team faced a 47-minute production outage after a routine networking update. Terraform Stacks now automate landing zone dependencies, preventing such disruptions through explicit, versioned relationships.

Why This Matters

Landing zone updates—networking, security, IAM—typically create invisible dependencies that break downstream applications. MyCoCo’s 47-minute outage highlighted the cost of manual coordination: engineering hours spent on Slack threads, incident response, and fragile data source references. Terraform Stacks transform this into an automated, visible dependency graph, reducing outages and coordination overhead.

Key Insights

• “47-minute outage triggered by landing zone update, 2025” (MyCoCo incident)
• “Linked Stacks over data sources for explicit dependencies” (Terraform Stacks formalize relationships)
• “Terraform Stacks used by MyCoCo for landing zone management” (HCP Terraform feature)

Working Example

# landing-zone/components.tfcomponent.hcl
component "vpc" {
  source = "./modules/vpc"
  inputs = {
    environment = var.environment
    cidr_block = var.cidr_block
    region = var.region
  }
  providers = {
    aws = provider.aws.main
  }
}
component "security_baseline" {
  source = "./modules/security"
  inputs = {
    vpc_id = component.vpc.vpc_id
    environment = var.environment
  }
  providers = {
    aws = provider.aws.main
  }
}

# landing-zone/deployments.tfdeploy.hcl
deployment "development" {
  inputs = {
    environment = "dev"
    cidr_block = "10.1.0.0/16"
    region = "ca-central-1"
  }
}
deployment "production" {
  inputs = {
    environment = "prod"
    cidr_block = "10.0.0.0/16"
    region = "ca-central-1"
  }
}

# landing-zone/deployments.tfdeploy.hcl (continued)
publish_output "vpc_id" {
  description = "Production VPC for application stacks"
  value = deployment.production.vpc_id
}
publish_output "private_subnet_ids" {
  description = "Private subnets for application workloads"
  value = deployment.production.private_subnet_ids
}

# product-stack/deployments.tfdeploy.hcl
upstream_input "landing_zone" {
  type = "stack"
  source = "app.terraform.io/mycoco/platform/landing-zone"
}
deployment "production" {
  inputs = {
    environment = "prod"
    vpc_id = upstream_input.landing_zone.vpc_id
    subnet_ids = upstream_input.landing_zone.private_subnet_ids
  }
}

Practical Applications

• Use Case: MyCoCo’s landing zone with automatic dependency propagation across five product stacks
• Pitfall: Using Terraform data sources instead of upstream_input blocks creates invisible dependencies, risking outages

References:

• https://dev.to/dc-shimla/terraform-stacks-mycocos-landing-zone-dependencies-done-right-2nna

---