Have you seen Terraform CDK? https://github.com/hashicorp/terraform-cdk

A CDK-style Terraform seems perfect. Seems a bit early days but I look forward to it gaining traction.

There are dozens of these examples. I switched a few years back after AWS released the automataic HTTP to HTTPS redirect functionality in ALBs and 6 months after release it still wasn't supported in CF. Terraform isn't perfect and it still has a ton of isues but it's rate of innovation is way a head of CF.

This is pretty straightforward in Pulumi. I recently built a stack that, in a single `pulumi up`, creates VPCs and subnets in a handful of different accounts with VPC peering, routing and DNS between each of them, including an AWS Client VPN set up so you can access all the VPCs from a single VPN endpoint.

Not sure if this official guidance is a 'horrific hack' but there are official AWS guidance on how to do this:

https://aws.amazon.com/blogs/infrastructure-and-automation/m...

Thank you, and yes in my books that's a horrific hack and too much effort compared to the 5 lines of code I just added to Terraform to get the job done.

I think the root reason for this is AWS stacks have to authenticate from a single origin (i.e. user credentials) instead of Terraform which can utilize multiple auths. This makes it necessarily complicated for AWS stacks when it tries to deploy another stack in another account, as the stacks are also account based. (but I imagine terraform stacks isn't).

FYI this has been supported in CDK for a few months now. See the CrossAccountZoneDelegation at the end of this section: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-route53-...