DevOps6 min read

Infrastructure as Code

Define, version, and automate cloud infrastructure with Terraform and Pulumi - reproducible environments, state management, and GitOps workflows.

Infrastructure as CodeTerraformPulumiIaCCloud

skill: Infrastructure as Code category: DevOps tags: [Infrastructure as Code, Terraform, Pulumi, IaC, Cloud] readingTime: 6

Infrastructure as Code is the only way to manage cloud resources at scale - click-ops (manual AWS console changes) creates invisible, unreproducible, undiffable infrastructure. IaC makes infrastructure reviewable, testable, and rollback-able. Terraform is the industry standard; Pulumi is better for teams that prefer their programming language over HCL.

Workflow

Structure a Terraform projectA well-structured Terraform project separates concerns, enables module reuse, and supports multiple environments without code duplication.
Write and apply Terraform resourcesTerraform's declarative HCL describes the desired state - Terraform computes what changes are needed and applies them safely.
Create reusable modulesModules encapsulate infrastructure patterns - a VPC module, an ECS service module - so environments share the same logic with different configurations.
Automate Terraform in CI/CDManual terraform apply creates drift - the person who knows the state is unavailable, changes are undocumented, and environments diverge. Automate apply in CI/CD.
Use Pulumi for TypeScript-native IaCPulumi lets you write infrastructure in TypeScript, Python, or Go - with real loops, conditionals, and type safety instead of HCL's limited templating.

Output Format

IaC project: Terraform modules, remote state, CI/CD automation, and separate environments for staging/production.

infrastructure/
  modules/       # reusable patterns
  environments/  # staging/, production/
    main.tf      # module instantiation
    backend.tf   # remote state (S3 + DynamoDB lock)
    *.tfvars     # environment-specific values

CI: plan on PR (comment output), apply on merge to main

Examples

Input

Output

Edge Cases & Gotchas

State file corruption - If terraform.tfstate is corrupted or lost (when not using remote state), Terraform loses track of all managed resources. Always use remote state (S3/GCS/Terraform Cloud) with locking from day one.
Resource drift - Manual changes in the AWS console create drift - Terraform state diverges from actual infrastructure. Run terraform plan regularly or use Terraform Cloud's drift detection to catch this.
Destroying production resources - terraform destroy is irreversible. Add lifecycle { prevent_destroy = true } to critical resources (RDS, production S3). Also use IAM policies to prevent engineers from running destroy in production.
Secrets in state - Terraform stores all resource attributes in state - including sensitive ones like database passwords. Enable state encryption (S3 server-side encryption) and use aws_secretsmanager_secret for secrets instead of resource attributes.

When to Break These Rules

Use AWS CDK (TypeScript) instead of Terraform for teams already deeply in the AWS ecosystem - CDK provides higher-level constructs (L2, L3) that encapsulate best-practice patterns.
Use Helm and ArgoCD for Kubernetes-specific configuration management - Terraform can manage Kubernetes resources but Helm charts + GitOps are the standard for K8s.

Reference Files

https://developer.hashicorp.com/terraform/docs
https://www.pulumi.com/docs/