---
title: "Infrastructure playbook · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure
updated: 2026-10-20
licence: "All rights reserved"
---

# Infrastructure and environments playbook

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

An infrastructure playbook for anyone who sets up or changes the machines, networks and accounts a service runs on. It works the same on AWS, Google Cloud, Azure, a smaller host or one rented server. It is written for the developer or the AI agent who makes the change, and for the owner who has to trust it.

Most cloud breaches and surprise bills start with one hand-made change. Somebody opened a port, kept an old key or forgot a test server. These rules put every change in code, check it before it ships, and keep each environment and key apart.

Start with [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code). Every other chapter assumes that changes go through code, review and CI. Then read [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access), because a leaked key does more harm than any other single mistake. If you run one server, read [Servers](https://agentwranglers.se/playbook/infrastructure/servers) next.

Running the service lives in the [operations playbook](https://agentwranglers.se/playbook/operations), including monitoring, backups, recovery and [containers](https://agentwranglers.se/playbook/operations/containers). Building and deploying the app lives in the [engineering playbook](https://agentwranglers.se/playbook/engineering). Attacks and their fixes live in the [adversarial testing playbook](https://agentwranglers.se/playbook/adversarial-testing).

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure`.

## Chapters

1. [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code): Create every resource from code in version control. Keep state locked and encrypted, review each plan, apply only from CI and catch drift daily. (6 required, 3 recommended)
2. [Environments](https://agentwranglers.se/playbook/infrastructure/environments): Give each environment its own account, build them all from the same code, change staging before production, and delete preview copies on time. (4 required, 2 recommended)
3. [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access): Sign people in through one identity provider, give every role the least it needs, keep no long-lived keys, and lock the root account away. (6 required, 1 recommended)
4. [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets): Keep settings in code and secrets in a store. Keep secrets out of state, let CI and services sign in with short-lived identity, and rotate on a timer. (4 required, 1 recommended)
5. [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns): Keep databases private, open only the ports you name, close admin ports to the internet, limit outbound traffic, force TLS and keep DNS in code. (6 required, 2 recommended)
6. [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code): Scan infrastructure code on every change, test your own rules against the plan, block dangerous actions at the organization level, and let exceptions expire. (2 required, 3 recommended)
7. [Servers](https://agentwranglers.se/playbook/infrastructure/servers): Replace servers instead of changing them by hand. Rebuild any server from code, install security updates by themselves, and close every port you do not use. (5 required, 1 recommended)
8. [Cost and ownership](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership): Tag every resource with its owner, give every account a budget with alerts, delete what sits idle, and size servers from what they use. (2 required, 2 recommended, 1 optional)

See all 51 rules on one page in the [checklist](https://agentwranglers.se/playbook/infrastructure/checklist).