Infrastructure as Code (IaC): Systems Automation

IaC is the practice of managing and provisioning infrastructure through machine-readable definition files, rather than manual hardware configuration or interactive web consoles.

1. Declarative vs. Imperative Paradigms

• Declarative (Terraform, CloudFormation): You define the End State (e.g., "I want 3 servers and a database"). The tool calculates the "diff" and applies the necessary changes.
  • Benefit: Idempotent and easier to reason about in large scales.
• Imperative (Pulumi, AWS CDK): You write Code (TypeScript, Python) that describes the steps to create resources.
  • Benefit: Full power of programming (loops, conditionals, testing libraries).

2. State Management

The tool must know what exists in the cloud to calculate changes.

• The State File: A JSON document mapping your code to real resource IDs.
• State Locking: Essential for team collaboration. Use a remote backend (S3 + DynamoDB) to prevent two developers from applying changes simultaneously, which leads to state corruption.

3. Concrete Implementation: Terraform

Terraform uses HCL (HashiCorp Configuration Language).

resource "aws_s3_bucket" "data" {
  bucket = "my-secure-data-bucket"
  
  versioning {
    enabled = true
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
}

• Modules: Reusable blocks of code (e.g., a "Standard VPC Module") that enforce organizational standards.

4. Policy as Code (PaC)

Integrate security into the IaC pipeline.

• Sentinel / OPA: Run automated checks before apply.
• Concrete Rule: Reject any terraform plan that creates an S3 bucket with public-read permissions.

---

See Also:

• Configuration Management — Managing the settings inside the infrastructure.
• Cloud Networking — The primary target for IaC.
• Cloud Cost Optimization — Tracking resources created by code.