For a long time, infrastructure was set up by hand: clicks in management consoles, settings according to instructions, adjustments as needed. The result is environments that differ in details, whose configuration hardly anyone fully knows and that take a long time to rebuild. Infrastructure as Code applies software development methods to infrastructure: it is described as code, versioned, reviewed and rolled out automatically. This approach is especially common in cloud environments, where resources are created and removed quickly.
How does Infrastructure as Code work?
- Declarative: The desired target state is described, for example three virtual machines, a network and certain firewall rules. The tool determines on its own which changes are needed. Well-known examples are Terraform or OpenTofu, as well as Bicep for Microsoft Azure.
- Imperative: Scripts define the individual steps, for example in PowerShell.
- Configuration management: Tools such as Ansible set up software and settings on existing systems.
A typical workflow: a change is made in a file, stored in a version control system such as Git and reviewed by a second person. A preview shows the planned effects, and then a pipeline rolls out the change. Good IaC is idempotent, meaning that applying it multiple times leads to the same result. Deviations caused by manual interventions, so-called drift, can be detected this way.
Typical examples
- The cloud environment for a new site is created from a proven template.
- A test environment is built identically to production and then removed again.
- Network and firewall rules are versioned, and every change is traceable.
- After a major outage, the infrastructure can be rebuilt from the code as a building block of disaster recovery. The data itself still needs a backup.
What companies should keep in mind
- Do not store passwords or keys in the code. State files of some tools can also contain sensitive data and must be protected.
- Avoid manual changes or add them to the code afterwards, otherwise drift occurs.
- Control changes via the four-eyes principle and change management.
- Start small, for example with new cloud resources, instead of converting all legacy systems at once.
- Code does not fully replace IT documentation: why something is built the way it is still needs to be described.
How it differs
A single script that is run once is not yet Infrastructure as Code. What matters is versioning, repeatability and that the code bindingly describes the target state.
View cloud services