Refactoring is the disciplined restructuring of configuration or code without changing existing infrastructure resources. In infrastructure as code (IaC), it reduces technical debt, limits change conflicts and blast radius, shortens feedback cycles, and helps adopt standardized infrastructure modules. section 10.0 section 10.1
Use a gradual workflow that preserves live resource state:
- Identify high-level resources with no dependencies and group them into a separate configuration, directory, or repository. section 10.2 section 10.2.3
- Copy the configuration, initialize separate state, and import the existing resources rather than recreating them. section 10.2.1
- Run a dry run or plan, deploy, and verify that the provider reports no unintended changes. section 10.2.1
- Remove the resources from the monolith’s state and configuration only after the separated configuration manages them successfully. section 10.2.1
- Repeat from higher-level dependent resources toward lower-level resources, using dependency injection to retrieve required identifiers. section 10.2.3 section 10.3
Extracting IAM from a monolithic GCP configuration
A configuration containing IAM roles and service accounts is copied into a separate directory while the live GCP resources remain unchanged. The resources are imported into the new state, Terraform plan reports no changes, and the IAM resources are then removed from the monolith’s state and code. The monolith can be applied again with zero resources added, changed, or destroyed. section 10.2.1
Figure 10.11 The workflow for refactoring an IaC monolith starts by identifying high-level resources with no dependencies.
Use the workflow figure to inspect the dependency-first order for breaking down an IaC monolith. section 10.2.3
