Infrastructure as Code (IaC)

IaC tools are categorized by their approach. Declarative (or functional) IaC defines the desired end state of the infrastructure (e.g., 'ensure 5 web servers exist'), leaving the tool to determine the execution sequence. Examples include Terraform, AWS CloudFormation, and Pulumi (in declarative mode). Imperative (or procedural) IaC defines the exact sequence of commands to execute to achieve a state (e.g., 'run this API call, then that one'). Examples include Ansible playbooks (though hybrid), Chef recipes, and shell scripts. Declarative is preferred for its idempotency and focus on outcome.

A fundamental property where applying the same IaC configuration multiple times results in the same infrastructure state, regardless of the starting point. This ensures safety and predictability.

• Prevents Configuration Drift: Repeated application corrects any manual changes, enforcing consistency.
• Enables Safe Re-runs: Automation pipelines can apply configurations without fear of creating duplicate resources.
• Implementation: Declarative tools are inherently idempotent. Imperative tools must be carefully designed to achieve idempotence through state checks.

The practice of replacing entire infrastructure components rather than modifying them in-place. Servers, containers, or network configurations are treated as disposable units built from a common, versioned artifact (e.g., an AMI, Docker image, or VM template).

• Eliminates Configuration Drift: No 'snowflake' servers with unique, undocumented changes.
• Simplifies Rollback: Revert to a previous known-good artifact.
• Enhances Security: Fresh deployments avoid persistent compromises. This is a key pattern enabled by IaC, contrasting with traditional mutable infrastructure management.

IaC encourages composing infrastructure from small, reusable, and shareable modules or components. This is analogous to functions or libraries in software.

• Terraform Modules: Encapsulate configuration for a logical component (e.g., a VPC, a Kubernetes cluster).
• AWS CloudFormation Nested Stacks / CDK Constructs: Promote reuse and abstraction.
• Benefits: Reduces duplication, enforces standards, simplifies complex deployments, and allows teams to share validated infrastructure patterns. A well-designed module exposes configurable inputs and produces consistent outputs.

IaC integrates seamlessly into modern CI/CD pipelines, automating the validation and application of infrastructure changes.

• Pipeline Stages: Typically include plan (preview changes), validate (syntax check), security scan (static analysis for misconfigurations), apply (provision), and test (conformance testing).
• Shift-Left for Security: Security and compliance checks (using tools like Checkov, Terrascan) are performed on the code before deployment.
• Environment Promotion: The same versioned IaC can be promoted through dev, staging, and production environments, ensuring parity. This principle bridges development and operations, a core tenet of DevOps.

IaC tools follow one of two core paradigms. Declarative (or functional) tools (e.g., Terraform, AWS CloudFormation) define the desired end state of the infrastructure, and the tool's engine determines the execution plan to achieve it. Imperative (or procedural) tools (e.g., Ansible, shell scripts) define the specific sequence of commands needed to create and configure resources. Declarative tools are generally preferred for infrastructure provisioning due to idempotency and ease of state management, while imperative tools excel at configuration management and orchestration tasks.

IaC tools follow one of two primary paradigms. Declarative IaC (e.g., Terraform, AWS CloudFormation) defines the desired end state of the infrastructure, and the tool determines the necessary steps to achieve it. Imperative IaC (e.g., Ansible playbooks, shell scripts) defines the specific sequence of commands to execute to configure the infrastructure. Declarative approaches are generally preferred for their idempotency and manageability of complex states.

A closely related practice focused on configuring and maintaining the software and state within provisioned servers. While IaC often handles the provisioning of the servers themselves, Configuration Management tools like Ansible, Chef, Puppet, and SaltStack manage:

• Installing and updating software packages.
• Managing configuration files and services.
• Enforcing security policies and user accounts. Together, IaC and Configuration Management provide a complete automation story from bare metal/cloud resource to a fully configured application.

A deployment model where infrastructure components (servers, containers) are never modified after deployment. Instead of patching or updating a live server, a new component is built from a common, versioned image (e.g., AMI, Docker container) and replaces the old one entirely. This paradigm:

• Eliminates configuration drift and "snowflake servers."
• Simplifies rollback and increases predictability.
• Is a natural fit for IaC, as the entire lifecycle—build, deploy, destroy—is codified.

An operational framework that extends IaC principles to application deployment and Kubernetes management. It uses Git repositories as the single source of truth for both infrastructure and application declarative specifications. Automated operators (like Flux or Argo CD) continuously monitor the Git repo and synchronize the state of the live system to match the declared state. Key principles include:

• Declarative descriptions stored in Git.
• Automated reconciliation of state.
• Software agent-driven pull-based deployment.
• Closed-loop feedback on system state.

The process of identifying differences between the infrastructure state defined in IaC code and the actual, running state of the infrastructure. Drift can occur due to manual hotfixes, direct console changes, or security patches. Effective IaC practices incorporate drift detection to:

• Alert on unauthorized or unexpected changes.
• Decide whether to revert changes or update the IaC code to match the new reality.
• Maintain security and compliance postures. Tools like Terraform Cloud and AWS Config provide built-in drift detection capabilities.

The practice of writing and managing governance, security, and compliance rules in machine-readable definition files. It integrates with IaC pipelines to enforce guardrails before infrastructure is provisioned. For example, a policy could block the creation of an S3 bucket without encryption enabled. Key tools include:

• Open Policy Agent (OPA) with its Rego language: A general-purpose policy engine.
• HashiCorp Sentinel: Used with Terraform Enterprise/Cloud.
• AWS Service Control Policies (SCPs) and Azure Policy: Cloud-native policy frameworks. This shifts security "left" in the development lifecycle, enabling automated compliance.