Immutability means creating a new infrastructure resource for every configuration change instead of modifying an existing resource in place. The old resource is then replaced or removed. This approach reduces configuration drift because the new resource is reproduced from infrastructure as code and aligned with its declared configuration. section 2.2 section 2.4
Apply immutability through an operational sequence:
- Define the desired resource configuration as code and keep it under version control. section 2.2.2
- Create a new resource containing the required change rather than updating the existing resource. section 2.2
- Test the new resource and dependent resources before directing live traffic to it. section 9.2.1
- Remove or replace the old resource after the new state is validated. section 2.2
- Repair failures by rolling forward a new working state; do not assume infrastructure can be restored exactly to a previous state. section 11.1.1 section 11.4
Immutability is especially useful when an in-place update could break incompatible packages or create an uncertain state. It supports reproducibility, limits localized configuration changes, and makes the declared IaC configuration the operational source of truth. Brownfield migration requires inventorying resources, reconstructing base dependencies first, matching actual state exactly, and reconciling drift. section 2.2 section 2.2.2
Upgrading a server without an in-place update
A server running Python 2 has packages that do not support Python 3. Instead of changing the server and risking unrelated failures, create a new server with Python 3 and compatible dependencies, test it, and delete the old server. Machine image builders apply the same pattern by generating a new image for updates and passing runtime-specific values through startup parameters. section 2.2
Figure 2.2 You treat the server mutably by logging in and updating the Python package version. By comparison, you treat the server immutably by replacing the old server with a new one upgraded to Python 3.
Compare an in-place Python package update with replacing the server through a newly created, upgraded resource. section 2.2
