Infrastructure as Code
Terraform, Pulumi, state management, modules - manage cloud infrastructure like code.
“ClickOps is when you manually provision servers in a web console. IaC is when your coworkers can review your infrastructure changes in a pull request.”
What you'll learn
ClickOps is a draft. IaC is the reviewable version
Infrastructure as Code means the cloud resources exist because a file said so, and that file can be reviewed. Terraform (HCL) is the common language. Pulumi is the same job in a general-purpose language. Cloud-native templates (CloudFormation, ARM, Deployment Manager) are fine if you have already married one cloud.
The point is not the logo. The point is that 'what is in AWS' and 'what we think is in AWS' can be diffed.
State is the part people skip and then page you about
Terraform state maps addresses in code to real objects. Lose state and Terraform wants to create everything again. Commit state to git and you have committed secrets, plus a merge conflict that can destroy a database.
Remote state: S3 plus a lock (DynamoDB), Terraform Cloud, GCS, Azure Blob. Locking is not optional. Two applies at once is how you get a VPC that is half a thought.
Modules are for repetition you can still explain
A module is a folder with main.tf, variables.tf, outputs.tf, and a README that is not a lie. Use a module when you create the same shape twice. Do not wrap a single aws_s3_bucket in a module because a blog said 'everything is a module'.
Pin module versions. source = git::...?ref=main is how a Monday morning apply imports someone else's Friday refactor.
Plan is the conversation. Apply is the commitment
terraform plan in CI on every pull request. Humans read the plan. terraform apply happens after merge, with the same backend, from a runner that is not a laptop. Local apply 'just this once' is how drift is born.
Drift happens anyway. Someone will click. Schedule a plan against reality. When the plan is noisy, fix the process that clicked, not just the state.
What not to put in the repo
Secrets. Account-wide *.tfstate. Unrelated environments in one root module with a boolean is_prod. That boolean will be wrong once.
Separate roots (or workspaces you actually understand) for prod. Use a secrets manager or CI-injected variables for credentials. The AWS access key in terraform.tfvars is a rite of passage you can skip.