Infrastructure as code (IaC) defines and manages infrastructure configurations through code and automation. Keeping those definitions in version control makes provisioning repeatable, changes traceable, and collaboration easier. It also helps teams deploy consistently across development, staging, and production rather than allowing each environment to acquire its own configuration. section 10.3.1
For cloud infrastructure, prefer declarative configuration: specify the resource and its parameters rather than scripting every setup step. Cloud vendor APIs perform much of the underlying work from those parameters. Step-oriented tools still have a place when configuring a server requires imperative actions; they need not drive every cloud-resource change. section 6.3.4
Treat infrastructure definitions as maintained software, not merely files accepted by an IaC framework:
- Keep shared infrastructure code DRY. Express the small differences between environments through parameters, such as Terraform tfvars, instead of copying code into folders or long-lived branches. section 6.3.3
- Keep pipelines focused on triggers and ordering. Put reusable logic in versioned shared code or local scripts, and retrieve required credentials from a secrets manager rather than duplicating them in pipeline settings. section 6.3.3
- Test reusable modules and intended resources, enforce conventions, and run recurring integration tests to catch manual changes made outside the pipeline. section 6.5
Provisioning across environments
A platform team defines cloud servers, databases, and networking in code, then uses automation to provision them across development, staging, and production. Version control records changes and supports rollback; consistent deployment reduces configuration drift. Terraform can define cloud resources, while Ansible remains an option for configuration tasks. section 10.3.1
Figure 6.10 Well-architected Infrastructure-as-code pipelines are no different from well-architected regular software pipelines. This is why we prefer the term “software-defined infrastructure” to differentiate between simply using an infrastructure-as-code (IaC) framework like Terraform and the software engineering practices that are a part of sustainable, high-quality software developer lifecycle management of an engineering platform product.
The pipeline diagram highlights the distinction between adopting an IaC framework and applying software-engineering practices to the infrastructure delivery lifecycle. section 6.3.3
