Introduction
Infrastructure as Code (IaC) has transformed how we manage cloud infrastructure. Instead of manually clicking through console interfaces, you define your infrastructure in code, version it, review it, and deploy it automatically.
This guide covers the major IaC tools and best practices for managing production infrastructure.
What is Infrastructure as Code?
IaC Principles
┌─────────────────────────────────────────────────────────────────┐
│ INFRASTRUCTURE AS CODE PRINCIPLES │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Core Principles: │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ ✓ Define infrastructure in code │ │
│ │ ✓ Version control (Git) for all configurations │ │
│ │ ✓ Automated testing and validation │ │
│ │ ✓ Peer review before changes │ │
│ │ ✓ Automated deployment pipelines │ │
│ │ ✓ Idempotent (same result every time) │ │
│ │ ✓ Document everything (code is documentation) │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Benefits: │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ ✓ Consistency across environments │ │
│ │ ✓ Version history and rollback │ │
│ │ ✓ Faster provisioning │ │
│ │ ✓ Reduced human errors │ │
│ │ ✓ Self-documenting infrastructure │ │
│ │ ✓ Enables GitOps workflows │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
IaC Tool Categories
┌─────────────────────────────────────────────────────────────────┐
│ IAC TOOL CATEGORIES │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ IMPERATIVE Tools │ │
│ │ Execute commands in sequence │ │
│ │ • AWS CLI │ │
│ │ • Azure CLI │ │
│ │ • gcloud CLI │ │
│ │ • Pulumi (programmatic) │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ DECLARATIVE Tools │ │
│ │ Define desired state, tool figures out how │ │
│ │ • Terraform (HCL) │ │
│ │ • CloudFormation (JSON/YAML) │ │
│ │ • Kubernetes (YAML) │ │
│ │ • Pulumi (declarative mode) │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ CONFIGURATION Management │ │
│ │ Configure running systems │ │
│ │ • Ansible │ │
│ │ • Chef │ │
│ │ • Puppet │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Terraform Deep Dive
Basic Terraform Workflow
┌─────────────────────────────────────────────────────────────────┐
│ TERRAFORM WORKFLOW │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ Write │───►│ Plan │───►│ Apply │ │
│ │ (.tf) │ │ (preview) │ │ (deploy) │ │
│ └─────────────┘ └─────────────┘ └─────────────┘ │
│ │ │ │ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ .tfstate file │ │
│ │ • Tracks created resources │ │
│ │ • Located locally or in remote backend │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Commands: │
│ • terraform init - Initialize working directory │
│ • terraform validate - Validate syntax │
│ • terraform plan - Preview changes │
│ • terraform apply - Apply changes │
│ • terraform destroy - Tear down resources │
│ • terraform state - Manage state │
│ │
└─────────────────────────────────────────────────────────────────┘
Terraform Configuration
# main.tf - Basic Terraform configuration
# Configure the AWS provider
provider "aws" {
region = "us-west-2"
# Use multiple profiles for different environments
alias = "main"
default_tags {
tags = {
Environment = "production"
ManagedBy = "Terraform"
}
}
}
# Terraform settings
terraform {
required_version = ">= 1.0"
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
# Remote state storage (recommended)
backend "s3" {
bucket = "my-terraform-state"
key = "prod/terraform.tfstate"
region = "us-west-2"
encrypt = true
dynamodb_table = "terraform-locks"
}
}
# Variables
variable "environment" {
description = "Environment name"
type = string
default = "production"
}
variable "instance_type" {
description = "EC2 instance type"
type = string
default = "t3.micro"
}
variable "vpc_cidr" {
description = "CIDR block for VPC"
type = string
default = "10.0.0.0/16"
}
# Create a VPC
resource "aws_vpc" "main" {
cidr_block = var.vpc_cidr
enable_dns_hostnames = true
enable_dns_support = true
tags = {
Name = "${var.environment}-vpc"
}
}
# Create subnets
resource "aws_subnet" "public" {
count = 2
vpc_id = aws_vpc.main.id
cidr_block = cidrsubnet(var.vpc_cidr, 8, count.index)
availability_zone = ["us-west-2a", "us-west-2b"][count.index]
tags = {
Name = "${var.environment}-public-subnet-${count.index + 1}"
}
}
# Internet Gateway
resource "aws_internet_gateway" "main" {
vpc_id = aws_vpc.main.id
tags = {
Name = "${var.environment}-igw"
}
}
# Security Group
resource "aws_security_group" "web" {
name = "${var.environment}-web-sg"
description = "Security group for web servers"
vpc_id = aws_vpc.main.id
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "${var.environment}-web-sg"
}
}
# EC2 Instance
resource "aws_instance" "web" {
ami = "ami-0c55b159cbfafe1f0" # Amazon Linux 2
instance_type = var.instance_type
subnet_id = aws_subnet.public[0].id
vpc_security_group_ids = [aws_security_group.web.id]
tags = {
Name = "${var.environment}-web-server"
}
}
# Outputs
output "vpc_id" {
description = "ID of the VPC"
value = aws_vpc.main.id
}
output "public_ip" {
description = "Public IP of the web server"
value = aws_instance.web.public_ip
}
Terraform Modules
┌─────────────────────────────────────────────────────────────────┐
│ TERRAFORM MODULES │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Module Structure: │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ my-module/ │ │
│ │ ┌─────────────────────────────────────────────────┐ │ │
│ │ │ main.tf (module logic) │ │ │
│ │ │ resource "aws_instance" "this" { ... } │ │ │
│ │ └─────────────────────────────────────────────────┘ │ │
│ │ ┌─────────────────────────────────────────────────┐ │ │
│ │ │ variables.tf (inputs) │ │ │
│ │ │ variable "instance_type" { ... } │ │ │
│ │ └─────────────────────────────────────────────────┘ │ │
│ │ ┌─────────────────────────────────────────────────┐ │ │
│ │ │ outputs.tf (outputs) │ │ │
│ │ │ output "instance_id" { ... } │ │ │
│ │ └─────────────────────────────────────────────────┘ │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Using a Module: │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ module "web_server" { │ │
│ │ source = "./modules/ec2" │ │
│ │ │ │
│ │ instance_type = "t3.micro" │ │
│ │ ami = "ami-xxx" │ │
│ │ environment = "production" │ │
│ │ } │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
# modules/vpc/main.tf
variable "vpc_cidr" {
description = "CIDR block for VPC"
type = string
}
variable "environment" {
description = "Environment name"
type = string
}
variable "availability_zones" {
description = "List of availability zones"
type = list(string)
default = ["us-west-2a", "us-west-2b"]
}
resource "aws_vpc" "main" {
cidr_block = var.vpc_cidr
enable_dns_hostnames = true
enable_dns_support = true
tags = {
Name = "${var.environment}-vpc"
}
}
resource "aws_subnet" "public" {
count = length(var.availability_zones)
vpc_id = aws_vpc.main.id
cidr_block = cidrsubnet(var.vpc_cidr, 8, count.index)
availability_zone = var.availability_zones[count.index]
tags = {
Name = "${var.environment}-public-${count.index + 1}"
}
}
output "vpc_id" {
value = aws_vpc.main.id
}
output "subnet_ids" {
value = aws_subnet.public[*].id
}
---
# main.tf - Using the module
module "vpc" {
source = "./modules/vpc"
vpc_cidr = "10.0.0.0/16"
environment = "production"
availability_zones = ["us-west-2a", "us-west-2b"]
}
AWS CloudFormation
CloudFormation Template
# cloudformation-template.yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: "VPC with public and private subnets"
Parameters:
EnvironmentName:
Type: String
Default: production
Description: Environment name
VPCCidr:
Type: String
Default: 10.0.0.0/16
Description: CIDR block for VPC
Resources:
# VPC
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: !Ref VPCCidr
EnableDnsHostnames: true
EnableDnsSupport: true
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-vpc
# Internet Gateway
InternetGateway:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-igw
InternetGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
# Public Subnet
PublicSubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: !Select [0, !CidrSplit [!Ref VPCCidr, 8]]
AvailabilityZone: !Select [0, !GetAZs '']
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-public-1
# Private Subnet
PrivateSubnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: !Select [1, !CidrSplit [!Ref VPCCidr, 8]]
AvailabilityZone: !Select [0, !GetAZs '']
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-private-1
# Route Table
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub ${EnvironmentName}-public-rt
PublicRoute:
Type: AWS::EC2::Route
DependsOn: InternetGatewayAttachment
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
SubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnet1
RouteTableId: !Ref PublicRouteTable
Outputs:
VPCId:
Description: ID of the VPC
Value: !Ref VPC
Export:
Name: !Sub ${AWS::StackName}-VPCID
PublicSubnet1Id:
Description: ID of the public subnet
Value: !Ref PublicSubnet1
Export:
Name: !Sub ${AWS::StackName}-PublicSubnet1
Pulumi
Pulumi Program
// Pulumi - TypeScript program
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";
// Get config
const config = new pulumi.Config();
const environment = config.require("environment");
const instanceType = config.get("instanceType") || "t3.micro";
// Create a VPC
const vpc = new aws.ec2.Vpc(`${environment}-vpc`, {
cidrBlock: "10.0.0.0/16",
enableDnsHostnames: true,
enableDnsSupport: true,
tags: {
Name: `${environment}-vpc`,
Environment: environment,
},
});
// Create subnets
const publicSubnet = new aws.ec2.Subnet(`${environment}-public-subnet`, {
vpcId: vpc.id,
cidrBlock: "10.0.1.0/24",
availabilityZone: "us-west-2a",
mapPublicIpOnLaunch: true,
tags: {
Name: `${environment}-public-subnet`,
Environment: environment,
},
});
const privateSubnet = new aws.ec2.Subnet(`${environment}-private-subnet`, {
vpcId: vpc.id,
cidrBlock: "10.0.2.0/24",
availabilityZone: "us-west-2a",
tags: {
Name: `${environment}-private-subnet`,
Environment: environment,
},
});
// Create security group
const webSg = new aws.ec2.SecurityGroup(`${environment}-web-sg`, {
description: "Security group for web servers",
vpcId: vpc.id,
ingress: [
{
protocol: "tcp",
fromPort: 80,
toPort: 80,
cidrBlocks: ["0.0.0.0/0"],
},
{
protocol: "tcp",
fromPort: 443,
toPort: 443,
cidrBlocks: ["0.0.0.0/0"],
},
],
egress: [
{
protocol: "-1",
fromPort: 0,
toPort: 0,
cidrBlocks: ["0.0.0.0/0"],
},
],
tags: {
Name: `${environment}-web-sg`,
Environment: environment,
},
});
// Create EC2 instance
const webServer = new aws.ec2.Instance(`${environment}-web`, {
ami: "ami-0c55b159cbfafe1f0",
instanceType: instanceType,
subnetId: publicSubnet.id,
vpcSecurityGroupIds: [webSg.id],
tags: {
Name: `${environment}-web-server`,
Environment: environment,
},
});
// Export outputs
export const vpcId = vpc.id;
export const publicIp = webServer.publicIp;
export const instanceId = webServer.id;
State Management
Remote State
┌─────────────────────────────────────────────────────────────────┐
│ TERRAFORM STATE MANAGEMENT │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Local State (Not Recommended for Teams): │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ terraform.tfstate stored locally │ │
│ │ • Doesn't work with team │ │
│ │ • No locking - concurrent changes cause conflicts │ │
│ │ • Lost if workstation fails │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Remote State (Recommended): │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Backend Types: │ │
│ │ • S3 + DynamoDB (AWS) - Most common │ │
│ │ • Azure Blob Storage │ │
│ │ • Google Cloud Storage │ │
│ │ • Terraform Cloud/Enterprise │ │
│ │ • Consul │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Key Benefits: │
│ ✓ Shared among team members │
│ ✓ State locking - prevents conflicts │
│ ✓ Encryption at rest and in transit │
│ ✓ Audit trail │
│ │
└─────────────────────────────────────────────────────────────────┘
State Locking
# S3 Backend with DynamoDB locking
terraform {
backend "s3" {
bucket = "my-terraform-state"
key = "prod/terraform.tfstate"
region = "us-west-2"
encrypt = true
dynamodb_table = "terraform-locks" # Required for locking
}
}
# Create DynamoDB table for locking
resource "aws_dynamodb_table" "terraform_locks" {
name = "terraform-locks"
billing_mode = "PAY_PER_REQUEST"
hash_key = "LockID"
attribute {
name = "LockID"
type = "S"
}
}
CI/CD for IaC
GitHub Actions for Terraform
# .github/workflows/terraform.yml
name: Terraform
on:
push:
branches: [main]
pull_request:
branches: [main]
env:
TF_VERSION: "1.5.0"
AWS_REGION: "us-west-2"
jobs:
terraform:
name: Terraform
runs-on: ubuntu-latest
environment: production
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Setup Terraform
uses: hashicorp/setup-terraform@v2
with:
terraform_version: ${{ env.TF_VERSION }}
cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ env.AWS_REGION }}
- name: Terraform Init
run: terraform init
working-directory: ./terraform
- name: Terraform Validate
run: terraform validate
working-directory: ./terraform
- name: Terraform Plan
if: github.event_name == 'pull_request'
run: terraform plan -no-color
working-directory: ./terraform
continue-on-error: true
- name: Terraform Apply
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
run: terraform apply -auto-approve
working-directory: ./terraform
Best Practices
IaC Security Best Practices
┌─────────────────────────────────────────────────────────────────┐
│ IAC SECURITY BEST PRACTICES │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Secret Management │ │
│ │ • NEVER commit secrets in code │ │
│ │ • Use secret management services │ │
│ │ • AWS: Secrets Manager, Parameter Store │ │
│ │ • Azure: Key Vault │ │
│ │ • GCP: Secret Manager │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Access Control │ │
│ │ • Use IAM roles, not access keys │ │
│ │ • Principle of least privilege │ │
│ │ • Enable MFA for console access │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ State Security │ │
│ │ • Use remote state with encryption │ │
│ │ • Enable state versioning │ │
│ │ • Restrict access to state files │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Code Review │ │
│ │ • Require PRs for all changes │ │
│ │ • Peer review infrastructure changes │ │
│ │ • Run plan before apply │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Testing │ │
│ │ • Validate syntax before apply │ │
│ │ • Use policy as code (OPA, Sentinel) │ │
│ │ • Test in non-production first │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Tool Comparison
┌─────────────────────────────────────────────────────────────────┐
│ IAC TOOL COMPARISON │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌───────────┬───────────┬───────────┬────────────────────┐ │
│ │ Feature │ Terraform │CloudFormation│ Pulumi │ │
│ ├───────────┼───────────┼─────────────┼────────────────────┤ │
│ │ Language │ HCL │ YAML/JSON │ TS/Py/Go/C# │ │
│ ├───────────┼───────────┼─────────────┼────────────────────┤ │
│ │ Provider │ Multi-cloud│ AWS only │ Multi-cloud │ │
│ ├───────────┼───────────┼─────────────┼────────────────────┤ │
│ │ State │ File/Remot│ JSON │ File/Remote │ │
│ ├───────────┼───────────┼─────────────┼────────────────────┤ │
│ │ Learning │ Medium │ Low │ Low (use lang) │ │
│ ├───────────┼───────────┼─────────────┼────────────────────┤ │
│ │ Community │ Large │ AWS-focused │ Growing │ │
│ ├───────────┼───────────┼─────────────┼────────────────────┤ │
│ │ Testing │ Good │ Limited │ Excellent │ │
│ └───────────┴───────────┴─────────────┴────────────────────┘ │
│ │
│ When to use what: │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Terraform: Multi-cloud, large community, mature │ │
│ │ CloudFormation: AWS-only, deep AWS integration │ │
│ │ Pulumi: Teams familiar with programming languages │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Conclusion
Infrastructure as Code is essential for modern cloud deployment. Key takeaways:
- Start with Terraform - Most widely adopted, large community
- Use remote state - S3 for AWS, with DynamoDB locking
- Modularize - Create reusable modules for common patterns
- Automate - CI/CD pipelines for all infrastructure changes
- Secure - Never commit secrets, use IAM roles, peer review
IaC transforms infrastructure management from manual, error-prone processes to automated, version-controlled, and repeatable workflows.
Comments