Infrastructure as code (IaC)

IaC tools fall into two families. Declarative provisioning tools - Terraform and its fork OpenTofu (HCL), AWS CloudFormation, Azure Bicep/ARM templates, Pulumi (general-purpose languages that build a declarative resource graph) and Crossplane (Kubernetes custom resources) - describe the end state and let an engine compute the steps. Configuration-management tools such as Ansible, Puppet and Chef converge the state of existing machines; Ansible playbooks are procedural in structure but are written to be idempotent, so re-running them on a correct system changes nothing. Idempotency and convergence are the core properties: applying the same code twice must yield the same infrastructure.

Terraform's workflow illustrates the mechanics. terraform plan refreshes the recorded state, calls provider APIs to read real resources, builds a dependency graph and prints a diff of creates, updates, in-place changes and replacements; terraform apply executes it, parallelising independent operations. The state file maps each resource address to its real-world ID and stores all attributes - including generated passwords and keys in plaintext - so it must live in a remote backend with encryption, strict access control and locking to prevent concurrent applies. Drift occurs whenever someone changes a resource outside the code; it is detected at the next plan (or by scheduled drift runs, or CloudFormation drift detection), and either imported back into code or overwritten. Immutable-infrastructure practice avoids in-place mutation altogether by replacing servers or images on every change.

In August 2023 HashiCorp moved Terraform from the MPL 2.0 to the Business Source License 1.1, prompting the community fork OpenTofu under the Linux Foundation, which has since added features such as client-side state encryption. Organisations should record which tool and licence they depend on, because provider and module ecosystems are shared but diverging.

Security benefits come from making configuration reviewable and testable before it exists: static analysers (Checkov, Trivy/tfsec, KICS) and policy-as-code engines (OPA/Conftest, HashiCorp Sentinel) check for public storage buckets, open security groups, missing encryption or logging, often mapped to CIS Benchmarks, and can block the pull request. IaC also introduces its own supply chain: providers and third-party modules run with the pipeline's cloud credentials, so versions should be pinned and the dependency lock file (.terraform.lock.hcl, which records provider checksums) committed. Plan output and logs can leak secrets, and the credentials used by apply are usually highly privileged, so federated short-lived identities and separate plan and apply permissions are standard. IaC is the declarative description; GitOps adds continuous, pull-based reconciliation of that description.