Creating a well-structured AWS virtual private cloud (VPC) by hand can take hours. Infrastructure as code (IaC) replaces that repeated manual work with code that describes the infrastructure to create. A Terraform configuration can define a VPC and its components once, then be reused to launch another copy. In one case, Terraform created more than 70 resources for a highly available VPC in about a minute. section 1.0
IaC is a class of technology for provisioning infrastructure using coding practices. It extends an evolution from configuring individual machines, through configuration management and reusable machine images, to defining and repeatedly deploying entire platforms. Terraform is one IaC tool; Pulumi, AWS CloudFormation, and GCP Deployment Manager are others. section 1.1
With Terraform, write the desired end state rather than a manual sequence of creation steps. When one resource uses a value from another, Terraform can infer their dependency and plan actions in the required order. For example, configuring an application with database credentials establishes that the database must be available first. Circular dependencies cannot form a valid plan. section 1.3 section 1.3.2 section 1.7
A practical Terraform workflow combines deployment with software-development safeguards:
- Run `terraform init` to obtain needed providers or modules, `terraform plan` to compare the workspace with the configuration, and `terraform apply` to execute the planned actions. section 1.7
- Keep configuration in version control. Use branches, pull-request reviews, linters, and automated tests to make changes easier to inspect and coordinate. section 1.1.1
- Scan code before deployment for security problems. Checkov and Trivy can provide automated checks, but neither replaces human review. section 7.4
Enforcing a storage choice
An infrastructure rule need not catch a syntax error to be useful. When AWS introduced GP3 volumes as a faster, cheaper replacement for GP2, a team could use a custom code rule to prevent new configurations from choosing GP2. Policy checks can address technical, compliance, or financial decisions; writing custom rules takes work. section 7.5
Treat the configuration as maintained software, not a one-time deployment script. Reusable building blocks make additional environments easier to create, while improvements to a shared module can benefit every project using it. Review and test changes before applying them: code makes infrastructure inspectable, but automated safeguards are not a substitute for judgment. section 1.0 section 1.1.1 section 7.4
