Infrastructure as Code

Infrastructure as Code (IaC) means describing infrastructure in files that are stored in version control and applied by tooling, instead of creating it by hand. The infrastructure can include networks, virtual machines, databases, load balancers, identity rules and managed Kubernetes clusters.

How it works

Most tools follow a similar loop. You write a definition of what you want, a tool compares it with what exists, and it shows a plan of the changes before applying them. Declarative tools such as Terraform describe the end state and work out the steps. Procedural or configuration tools such as Ansible describe tasks to run, though they are often written to be repeatable.

Declarative tools keep a record of what they manage, often called state. That record must be stored safely, protected from concurrent changes and kept separate from secrets where possible. Because definitions are files, changes go through pull requests, automated checks and review, and a previous version can be restored from history.

A practical example

A team needs a staging environment that matches production but is smaller. They reuse the same module that builds production and pass different variables for size and count. The plan output is reviewed in a pull request, the change is applied by a pipeline, and the environment can later be destroyed when no longer needed.

Common mistakes

• Creating resources by hand in a console and never importing them, which causes drift. This practice is covered under ClickOps.
• Keeping state on a laptop or in an unprotected location, so two people cannot safely apply changes.
• Writing one very large configuration for everything, which makes plans slow and the blast radius of mistakes large. Split by environment and ownership.
• Hard-coding secrets in definitions that are committed to Git.
• Applying changes from individual machines instead of a controlled pipeline.

When to use it and when not to

IaC pays off when infrastructure is created more than once, shared by several people, or subject to audit. It is valuable for disaster recovery, since an environment can be rebuilt from code. It is less useful for a short-lived experiment where the console is faster, though anything that survives the experiment should be brought into code. For adoption help, see our Terraform and IaC service and the technology overview.

See also

• Terraform
• Ansible
• ClickOps
• GitOps