DevOps Peach

Linux · Terraform – Infrastructure as Code · Lesson 1 of 5

Infrastructure as Code

Manage infrastructure as versioned, reviewable code.

Practice interactively →

From clicks to code

Infrastructure as Code (IaC) describes infrastructure in files instead of depending on manual clicking. Code can be reviewed, versioned, tested, and rerun for development, test, and production, reducing configuration drift and snowflake environments.

The practical gains are wide: a new environment can be created in minutes, a region can be rebuilt after a disaster, every change has an author and a reason in Git history, and the files themselves document what exists.

flowchart LR
  DEV["Engineer<br/>edits .tf"] --> GIT["Git<br/>pull request"]
  GIT --> REV["Review<br/>plan output"]
  REV --> CI["CI pipeline<br/>plan, apply"]
  CI --> CLOUD["Cloud resources<br/>VPC, VM"]
  CLOUD -. "drift" .-> REV
  %% step DEV: Infrastructure is described in code files instead of console clicks.
  %% step GIT: Changes go through version control, so history and blame exist.
  %% step REV: Teammates review the change and its plan before anything is created.
  %% step CI: A pipeline applies the reviewed code the same way every time.
  %% step CLOUD: The result matches the code; the same code builds dev and prod.
  %% step REV: Manual console changes cause drift, which the next plan reveals.

Declarative and procedural

Declarative configuration states a desired result; an engine builds a graph and selects operations. Procedural automation states a sequence of steps. The styles can be combined, but Terraform is primarily declarative.

Classification Meaning
Mutable Update an existing resource in place
Immutable Create a replacement, then move traffic or state
Agent A persistent worker runs on the target
Agentless Control through an existing API or transport

Immutable does not mean every resource is always replaced; lifecycle depends on provider schema and the changed attribute.

The tool landscape

Tool Scope
Terraform, OpenTofu Multi-cloud provisioning with HCL; OpenTofu is the open-source fork created after Terraform's 2023 licence change
AWS CloudFormation, AWS CDK AWS only; CDK generates CloudFormation from TypeScript, Python…
Azure Bicep, ARM templates Azure only
Pulumi Provisioning in general-purpose languages
Ansible Mainly configuration inside servers

IaC is not limited to public cloud: providers manage SaaS, Kubernetes, DNS, virtualization, and local or container resources.

Working as a team

IaC usually follows the same flow as application code: a branch, a pull request that shows the plan output, review, then apply from a pipeline rather than from a laptop. Tools such as tflint catch mistakes and policy scanners such as Checkov flag insecure settings like a public bucket.

Drift happens when someone changes a resource by hand. A regular plan reveals it, and the fix is to bring the code and the real object back into agreement instead of leaving them different.

Secrets

Source control alone does not protect secrets. Classify configuration, variable files, state, and plan artifacts; state commonly contains sensitive attributes even when UI output is marked sensitive.

Practice interactively →