Infrastructure as code
Declarative infra, reviewable change, and drift control — treating environments like software.
Infrastructure as code (IaC) makes environments reviewable, repeatable, and recoverable — the DevOps counterpart to application CI.
Why it matters
Click-ops creates snowflake accounts nobody can rebuild. IaC puts network, compute, IAM, and data stores in version control with the same PR discipline as app code.
Principles
- Declarative desired state (Terraform, CloudFormation, Pulumi, cluster manifests) over unreproducible scripts when possible
- Plan then apply with human review for risky changes
- Modules for paved roads; escape hatches documented
- Secrets out of git — inject via stores, not plaintext
Drift
Reality diverges when people change the console. Detect drift, reconcile toward git, and make break-glass changes rare and audited.
Environments
Promote modules/versions across env — not copy-paste forks that rot. Parity need not mean identical scale; it means same shape and config mechanism.
Limits
IaC does not replace architecture judgment. A reviewed Terraform PR can still provision an unsafe design. Pair with policy-as-code and least-privilege defaults.