Infrastructure as Code (IaC)
Defining cloud infrastructure in version-controlled files instead of console clicks — reviewable, repeatable, and recoverable.
What is IaC?
Infrastructure as Code means your VPCs, databases, IAM policies, and clusters are declared in files — Terraform/OpenTofu (the multi-cloud standard), Pulumi (real programming languages), CloudFormation/CDK (AWS-native) — and a tool reconciles the cloud to match. The console becomes read-only; changes go through pull requests like application code.
Why it’s non-negotiable past a certain size
Click-built infrastructure (“ClickOps”) is unreproducible — nobody knows why that security group rule exists, staging drifts from production, and disaster recovery means archaeology. IaC gives you review (infra changes get PR scrutiny — crucial for IAM and network rules), reproducibility (spin up an identical environment from the repo), and an audit trail (git blame for your firewall).
The core concepts
Declarative state: you describe the destination, the tool computes the diff. Plan before apply: every change shows exactly what will be created, modified, or destroyed — read the destroys. State files: the tool’s record of what it manages; corrupt or conflicting state is the classic IaC incident, so use remote state with locking. Drift: manual console changes diverge from code until the next apply reverts them — surprising exactly once.
Cost reality
IaC’s cost benefit is indirect but large: environments can be torn down and recreated (dev/staging that only exist during work hours), unused resources are visible in code review, and cost-estimation tools (Infracost) can price a PR before it merges. The investment is the learning curve and the discipline of never fixing things in the console.
What people get wrong
- Secrets in state or code. State files contain resource attributes including generated passwords — encrypt state, use secret managers, never commit either.
- One giant root module. A single state file for the whole company makes every change slow and risky; split by team/environment blast radius.
- IaC for infra, ClickOps for IAM. The permissions are the most security-critical part — they belong in code review most of all.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.