Infrastructure as Code (IaC)
Defining cloud infrastructure in version-controlled files instead of console clicks — reviewable, repeatable, and recoverable.
Last reviewed: July 25, 2026
What is IaC?
Infrastructure as Code means your VPCs, databases, IAM policies, and clusters are declared in files — Terraform/OpenTofu (the multi-cloud standard), Pulumi (real programming languages), CloudFormation/CDK (AWS-native) — and a tool reconciles the cloud to match. The console becomes read-only; changes go through pull requests like application code.
Why it’s non-negotiable past a certain size
Click-built infrastructure (“ClickOps”) is unreproducible — nobody knows why that security group rule exists, staging drifts from production, and disaster recovery means archaeology. IaC gives you review (infra changes get PR scrutiny — crucial for IAM and network rules), reproducibility (spin up an identical environment from the repo), and an audit trail (git blame for your firewall).
The core concepts
Declarative state: you describe the destination, the tool computes the diff. Plan before apply: every change shows exactly what will be created, modified, or destroyed — read the destroys. State files: the tool’s record of what it manages; corrupt or conflicting state is the classic IaC incident, so use remote state with locking. Drift: manual console changes diverge from code until the next apply reverts them — surprising exactly once.
Cost reality
IaC’s cost benefit is indirect but large: environments can be torn down and recreated (dev/staging that only exist during work hours), unused resources are visible in code review, and cost-estimation tools (Infracost) can price a PR before it merges. The investment is the learning curve and the discipline of never fixing things in the console.
What people get wrong
- Secrets in state or code. State files contain resource attributes including generated passwords — encrypt state, use secret managers, never commit either.
- One giant root module. A single state file for the whole company makes every change slow and risky; split by team/environment blast radius.
- IaC for infra, ClickOps for IAM. The permissions are the most security-critical part — they belong in code review most of all.
IaC Testing and Validation Practices
As infrastructure-as-code configurations have grown more complex, dedicated testing practices have emerged around them, mirroring software testing disciplines: static analysis tools check configurations for security misconfigurations and policy violations before they’re ever applied, plan/preview commands (like terraform plan) let engineers review exactly what changes would be made before committing to them, and some teams maintain automated integration tests that actually provision test infrastructure in an isolated environment to verify a configuration works as intended. This growing testing discipline reflects how thoroughly infrastructure-as-code has matured from a simple scripting convenience into a practice treated with the same rigor as application code, including code review, automated testing, and CI/CD pipeline integration before changes reach production infrastructure.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.