rgoussu.dev
rgoussu@goussu: ~/library/platform
❯ ~/library/platform cat infrastructure-as-code.md

Infrastructure as code

# Infrastructure as reviewable text — declarative state, the plan/apply loop, state management, and the drift problem.

Conceptsaved 2026-08-08updated 2026-08-20 #iac#terraform#platform#automation#devops

Overview

Infrastructure as code replaces console-clicking with declarative definitions in version control: infrastructure becomes reviewable, repeatable, and destroyable-recreatable. The dominant model (Terraform/OpenTofu) is declarative with explicit state — you describe the target, the tool diffs it against recorded reality and shows a plan before touching anything. The concepts transfer across tools; the discipline (review plans, never click) is the actual product.

Key points

  • The plan/apply loop: declare resources → plan computes a diff (create/update/ destroy — read plans like PRs; the tool will cheerfully plan to delete your database) → apply executes it. The plan is the review artifact; auto-apply without a reviewed plan is how outages ship.
  • State is the crux: Terraform's state file maps declarations to real resource IDs — it must be remote, locked, and treated as sensitive (it contains secrets); most advanced pain (imports, moves, corruption) is state surgery. Alternatives trade this differently: CloudFormation/ARM keep state provider-side; Crossplane/Kubernetes-style IaC replaces one-shot plans with continuous reconciliation.
  • Drift: manual console changes diverge reality from code until the next plan "wants" to undo them — detect it (scheduled plans), forbid its source (read-only console access in serious shops), and import what must stay.
  • Modules & composition: parameterized modules for repeated shapes (a "service" = ALB + service + DNS + alarms); keep root configurations thin; version modules like libraries. Separate state per environment/blast-radius domain — one giant state file is one giant outage.
  • The language spectrum: HCL (declarative, constrained), CDK/Pulumi (real languages — power and the temptation to be clever), Helm/Kustomize as the Kubernetes-manifest cousins. Constraint is a feature: infrastructure code is read under incident pressure.
  • Pipeline integration: plan on PR (posted as comment), apply on merge, with policy checks (OPA, tflint, cost estimation) as gates — infrastructure gets the same CI/CD treatment as application code. No secrets in code or state where avoidable (secrets management).
  • To explore: GitOps (Argo/Flux) as reconciliation-style IaC for clusters, Terragrunt/ workspaces for multi-env layout, ephemeral environments per PR, immutable infrastructure (replace, don't patch).

Practice

  • Terraform tutorials, plan-first (source) — work the getting-started track but read every plan line by line before applying, predicting the diff; teaches the plan/apply loop as a review habit, not a formality.
  • Drift-and-import drill (source) — break your own stack from the console (rename a tag, tweak a rule), watch the next plan want to undo it, then import a resource created entirely by hand; teaches drift detection and state surgery on a stack you can afford to lose.
  • Extract a module (source) — refactor a copy-pasted "service" shape (LB + service + DNS + alarms) into a parameterized, versioned module with thin roots and separate state per environment; teaches composition and blast-radius layout.
  • Test a module with Terratest (source) — write Go tests that apply your module against a real account, assert on outputs and reachability, and destroy; teaches infrastructure code as testable software.
  • Plan-on-PR pipeline with Atlantis (source) — wire plan-as-PR-comment and apply-on-merge with a policy check as gate; teaches the full CI/CD treatment of infrastructure, review artifact included.

Related