A source of truth is the single, consistent representation of infrastructure state and desired configuration. In infrastructure as code, version-controlled configuration declares the desired end state, while automation determines how to reach it. section 2.1
Treat the source of truth as the ownership boundary for changes. Manual changes create drift; reconciling the actual resource with version-controlled configuration restores reproducibility and supports repeatable, idempotent deployment. section 2.2.1 section 2.4
Use the pattern operationally by:
- Declaring the desired infrastructure state in version-controlled configuration rather than recording a sequence of manual steps. section 2.1
- Reconciling any out-of-band change by updating the configuration immediately after changing the live resource. section 2.2.1
- Migrating brownfield infrastructure from base resources and dependencies outward, matching existing state before applying IaC. section 2.2.2
- Removing refactored resources from the old configuration and state so two IaC definitions cannot manage the same resource. section 10.2.1
- Using commits and ticket identifiers to preserve change context, traceability, and a reproducible history. section 2.3.1
Migrating an existing environment
For a brownfield environment containing networks, servers, load balancers, firewalls, and DNS entries, first reconstruct the networks in IaC. Match their names and CIDR blocks to the live resources, then migrate dependent resources. If the configuration differs from reality, applying it may damage the network and the resources running on it. During refactoring, import existing resources, verify that planning reports no differences, and remove their definitions and state entries from the former monolith. section 2.2.2 section 10.2.1
Figure 2.6 The decision workflow for migration helps you decide how to import your infrastructure with a provisioning tool, re-create a resource, or build conditional statements to check for resource existence. No matter which option, you must rerun your IaC and reconcile any drift.
Use the migration decision workflow to choose whether to import a resource, recreate it, or conditionally check for its existence before rerunning IaC and reconciling drift. section 2.2.2
