Infrastructure as Code

Introduction

Clicking through a web console is fine for learning, but it does not scale. Nobody remembers every click, two environments drift apart, and a disaster means rebuilding by hand. Infrastructure as code (IaC) describes your infrastructure in text files that you keep in version control, review and run automatically.

The simple explanation

Instead of doing the steps, you write down the result you want, and a tool makes reality match.

Benefits

• Repeatable: build identical test and production environments.
• Reviewable: changes go through pull requests like any code.
• Versioned: see who changed what, and roll back.
• Fast recovery: recreate an environment from files.
• Documented: the code is the truth about what exists.

Declarative style

Most tools, including Terraform, OpenTofu, and provider tools such as CloudFormation and Bicep, are declarative. You describe the desired end state. Here is a Terraform-style example, shown for reading, that defines a storage bucket:

resource "aws_s3_bucket" "reports" {
  bucket = "my-company-reports-2026"

  tags = {
    Environment = "production"
    Owner       = "data-team"
  }
}

A resource block says "there should be a thing of this type, with these settings". The tool works out how to create it, or update it if it already exists.

Plan, apply, state

The usual workflow:

1. Write or change the configuration files.
2. Plan (terraform plan): the tool shows exactly what it would create, change or destroy, without doing it. Read the plan carefully, especially lines that destroy things.
3. Apply (terraform apply): carry out the changes.

The tool keeps a state file that records what it manages and maps your code to real resources.

• Store state in a remote, access-controlled, locked location, not on one laptop, so a team does not overwrite each other.
• State can contain secrets, so protect it.
• Never edit state by hand unless you know exactly what you are doing.

Good habits

• Modules: reusable packages of configuration, for example "a standard web service".
• Variables and environments: the same code with different inputs for development and production.
• Pipelines: run format checks, validation and plans automatically on pull requests, with approval before apply.
• No manual changes to managed resources. Changes outside the code cause drift. Detect and fix it.
• Never put secrets in code files. Use a secrets manager, and mark sensitive values.
• Pin versions of tools and providers.
• Scan configurations for security mistakes before applying.

Configuration management and other tools

IaC creates the infrastructure. Other tools, such as Ansible, configure software inside machines. Containers and image builders reduce the need for it. Kubernetes manifests are also a form of declarative code.

Try it yourself

Pick something you built by clicking in a console, such as a bucket or a virtual machine. Write down, in plain words, every setting it has. Then think how a team member could review a change to it before it is applied.

Summary

• IaC describes infrastructure in version-controlled files, which gives repeatable, reviewable environments.
• Declarative tools compare the desired state with reality, and show a plan before apply.
• Protect state, avoid manual changes and secrets in code, and run plans through a pipeline with approval.