Skip to main content

Infrastructure as Code (IaC)

TL;DR
  • IaC (Infrastructure as Code) means defining infrastructure, networks, VMs, load balancers, databases, in configuration files instead of setting it up by hand, so it can be built, changed, and destroyed repeatably.
  • IaC vs. IaaS: they're not the same thing. IaaS (Infrastructure as a Service) is what you're renting, raw compute/storage/networking from a cloud provider. IaC is how you manage it, as versioned code, regardless of which IaaS provider you're using.
  • Declarative vs. imperative: most modern IaC (like Terraform) is declarative, you describe the desired end state, and the tool figures out how to get there, rather than scripting each step.
  • Main benefits: faster provisioning, consistent environments, a version-controlled audit trail, fewer manual errors, and the ability to spin environments up and down on demand.
  • Popular tools: Terraform, Ansible, AWS CloudFormation, Azure ARM/Bicep, and Pulumi.

Managing IT infrastructure used to be a manual, error-prone process. System administrators would configure servers one by one, relying on detailed documentation and custom scripts that quickly became outdated. This approach was slow, inconsistent, and couldn't keep up with the demands of modern applications.

Infrastructure as Code (IaC) solves this by treating infrastructure, networks, virtual machines, load balancers, and databases, like software. Instead of manual setup, you define your infrastructure in configuration files, which you can build, change, and manage in a safe, consistent, and repeatable way.

IaC vs. IaaS​

These two terms get confused because they're both about cloud infrastructure, but they answer different questions:

  • IaaS (Infrastructure as a Service) is a cloud service model, renting raw compute, storage, and networking from a provider like AWS, Azure, or GCP instead of buying physical hardware.
  • IaC (Infrastructure as Code) is a practice for managing infrastructure, defining it in version-controlled configuration files instead of clicking through a console or running ad-hoc scripts.

You can use IaC to provision IaaS resources (a Terraform config that creates EC2 instances), but you can also use IaC to manage platform-as-a-service or serverless resources that have nothing to do with IaaS. The two aren't interchangeable.

The evolution of infrastructure management​

Managing infrastructure has changed a lot over time:

  1. Manual configuration: Initially, system administrators configured everything by hand. This was time-consuming and led to inconsistencies, where a "production" server might have slightly different settings than a "staging" server, which caused bugs that were hard to track down.
  2. Configuration management: As cloud computing grew, tools like Ansible, Puppet, and Chef emerged. These tools automate the configuration of software and settings on existing machines, which keeps configuration consistent across many servers. Tools like Packer also helped by creating pre-configured "golden images" for reuse.
  3. Infrastructure as Code: IaC goes a step further. Instead of just configuring existing machines, IaC tools like Terraform automate the creation, modification, and destruction of the infrastructure itself. That lets you define an entire cloud environment (the virtual network, databases, and servers) in code.

How does IaC work? Declarative vs. imperative​

IaC tools generally follow one of two approaches:

  • Declarative (What): You define the desired state of your system. For example, "I want three web servers, a load balancer, and a database." You don't specify how to create them. The IaC tool figures out the necessary steps to achieve that state. Terraform is a leading declarative tool, the most common approach today.
  • Imperative (How): You write a script that specifies the exact commands to execute in order. For example, "First, create a virtual network. Second, create three servers. Third, configure the load balancer." Early automation scripts and some configuration management tools can work this way.

The declarative model is generally preferred because it is more resilient and predictable. If you make a change to your definition file, the tool can calculate the difference and apply only the necessary updates, additions, or deletions.

Key benefits of adopting IaC​

Treating your infrastructure as code is central to modern DevOps practices, for a few reasons:

  • Automation and speed: Provisioning a complete production environment can take minutes instead of days or weeks, which cuts manual effort and speeds up development cycles.
  • Consistency and reproducibility: By defining infrastructure in code, you eliminate configuration drift. Every environment, from development to production, comes from the same source and stays identical.
  • Version control: Storing your infrastructure definitions in a version control system like Git provides a full audit trail. You can see who changed what, when, and why. It also enables collaboration, code reviews, and the ability to roll back to a previous state if something goes wrong.
  • Reduced risk and increased reliability: Automation minimizes the potential for human error during configuration. You can also test your infrastructure code before deploying it, just like application code, to catch issues early.
  • Cost reduction: IaC helps optimize resource usage by making it easy to create and destroy environments on demand. For example, you can automatically spin up a testing environment to run a test suite and then tear it down immediately afterward, so you only pay for what you use.
  • Terraform: An open-source tool from HashiCorp that has become the industry standard for infrastructure provisioning. It uses a declarative approach and supports hundreds of cloud providers and services through its extensive provider ecosystem.
  • Ansible: An agentless automation tool built for configuration management and deploying applications. While it can perform some provisioning, it's often used to configure servers after they've been created by a tool like Terraform.
  • AWS CloudFormation: A service provided by Amazon Web Services that allows you to model and provision AWS resources using YAML or JSON templates. It is tightly integrated with the AWS ecosystem but is limited to AWS resources.
  • Azure Resource Manager (ARM) Templates: The native IaC solution for Microsoft Azure, similar to CloudFormation for AWS.
  • Pulumi: A modern IaC tool that lets you define infrastructure using general-purpose programming languages like Python, TypeScript, Go, and C#.