Infrastructure as Code (IaC)
The practice of managing and provisioning computing infrastructure through machine-readable definition files.
Detailed Explanation
Instead of manually configuring servers or using a cloud console, IaC allows you to write code (using tools like Terraform or CloudFormation) to define your network, databases, and servers. This makes infrastructure version-controlled, repeatable, and less prone to human error. It is a cornerstone of modern DevOps automation.
Quick Summary
Infrastructure as Code defines cloud and on-prem resources in versioned text files instead of clicking through a console. The same workflow that ships application code, review, test, deploy, applies to infrastructure changes.
Key Takeaways
- Declarative tools (Terraform, Pulumi, CloudFormation) describe desired state; imperative tools (Ansible, scripts) describe steps to reach it.
- State files track which real resources correspond to which code definitions, losing state is the #1 IaC disaster.
- Every change goes through a plan/diff step before apply, so you see what will be created, modified, or destroyed.
- Modules and stacks let you reuse the same code across environments (dev/staging/prod) with parameterized inputs.
- Drift, when someone changes infra outside of code, is the recurring problem IaC tools must detect and reconcile.
When to use it
- Provisioning cloud accounts from scratch in a reproducible, peer-reviewable way.
- Spinning up identical staging environments per branch for preview deploys.
- Disaster recovery: rebuilding an entire region from code if a provider has an outage.
- Compliance: auditors can read code and history instead of interviewing operators.
Common Mistakes
- Hand-editing resources in the console and forgetting to mirror the change in code, causes drift and next-apply surprises.
- Committing state files to public repos (they often contain secrets); use a remote backend with encryption.
- One giant Terraform root that takes 20 minutes to plan and locks out the whole team, split into smaller stacks.
- Treating IaC as write-once; it is application code and needs the same refactoring, testing, and CI discipline.
Infrastructure as Code (IaC), Frequently Asked
Terraform vs. CloudFormation vs. Pulumi?
Terraform is multi-cloud and uses HCL. CloudFormation is AWS-only but tightly integrated. Pulumi uses real programming languages (TS, Python, Go) and is best when you want loops, conditionals, and reusable abstractions beyond what HCL offers.
Should I use IaC for a single small project?
Even a one-person side project benefits, you get a record of what's running and the ability to tear down and rebuild without thinking. The overhead is small once the initial setup is done.
How do I handle secrets in IaC?
Don't put them in code. Reference secrets from a secrets manager (AWS Secrets Manager, Vault, SOPS-encrypted files) and let the IaC tool pull them at apply time. State files should be encrypted at rest in case secrets leak into them.