Why infrastructure as code

Clicking through a cloud console works until it doesn't. Someone creates a production database by hand, nobody records the settings, and six months later a new region needs the same stack and nobody can rebuild it. Infrastructure as code (IaC) fixes this by storing resources as declarations in a repository. Changes go through review, a pipeline applies them, and a tool checks the files against reality.

The big idea

There are two ways to describe the same setup.

• Imperative scripts say how: create subnet A, then create subnet B, then attach both. Run the script twice and step 1 may fail or create a duplicate.
• Declarative config says what: "three private subnets and one Multi-AZ database." The tool works out the steps from the current state.

Terraform is declarative. A shell script full of aws ec2 calls is imperative. A declarative file is safe to run again, because the tool only changes what differs from the desired state.

Walking through drift

Drift is the gap between the file and the real resource. It usually comes from a manual change in the console.

Day 0  Code says alarm threshold = 80% CPU. Reality: 80%.
Day 1  Engineer edits the alarm in the console to 95% to stop the noise.
       Reality: 95%. Code: still 80%.
Day 2  Next plan sees 95 vs 80 and proposes setting it back to 80.

Either the fix is lost on the next apply, or someone copies it into the code. The bad case is when nobody reads the plan and the fix quietly disappears.

Walking through a ClickOps failure

An engineer creates an RDS database in the console with encryption off, "just for a quick test." The app then points at it, and it becomes production. Months later a compliance scan finds unencrypted data.

With IaC, encryption is a variable in a shared module. It shows up in every plan, and a second region gets the same setting automatically.

Common mistakes

• Treating IaC as a one-time script. Once the console is used again, the files and reality drift apart.
• Thinking IaC removes judgment. It makes judgment visible. Every change is a diff a reviewer can read.
• Calling an imperative script IaC. Re-running it can fail halfway or duplicate resources.

Check yourself

1. Why is a shell script of aws ec2 calls imperative? Answer: it lists steps to run in order, so a second run can fail or duplicate what earlier steps already created.
2. A teammate changes a security group in the console. What is that, and what should happen next? Answer: drift. Put the change in code, or apply the code to revert it.

Key takeaways

• IaC stores infrastructure as reviewable, repeatable declarations.
• Declarative says what you want. Imperative says how, step by step.
• Drift is the gap between the file and reality. Manual edits create it.
• Next, read the Terraform overview to see the tool that does this.

Further learning

Armon Dadgar's short talk on infrastructure as code, and why point-and-click fails at scale. It is good framing before you touch HCL.