Infrastructure as code

Infrastructure as code means a file describes each server, database, network and DNS record. A tool compares the file with what exists and makes the difference. The examples use OpenTofu and Terraform, which share one language. Pulumi, AWS CloudFormation, Azure Bicep and Google's Config Connector follow the same rules.

Required

• Define every resource in code

  Required

  Create and change every cloud resource, firewall rule and DNS record through code in version control. Never make a lasting change in a web console.

• Keep state remote with locking and encryption

  Required

  Keep the state file in a remote backend that locks, encrypts and keeps old versions. Only the deploy roles may read it. Never keep state in git or on a laptop.

• Review the plan and apply only from CI

  Required

  Post the plan in every pull request. Apply only from CI after merge, from the plan file made for that commit. No person applies from a laptop.

• Pin the tool and provider versions

  Required

  Pin the version of the tool and of every provider, and commit the provider lock file with hashes for every platform you run on.

• Detect drift every day

  Required

  Run a plan against every state at least once a day. Open a ticket when it finds a change nobody made in code.

• Protect resources that hold data

  Required

  Turn on deletion protection for every database, bucket and disk that holds data. Stop any plan that deletes or replaces one until a second person approves.

Recommended

• Split state by environment and layer

  Recommended

  Give each environment and each layer its own state, such as network, data and app. One mistake then touches only one of them.

• Reuse versioned modules

  Recommended

  Put each repeated pattern in a module with checked inputs, and pin every use of it to a version. Never copy the same resources between environments.

• Bring hand-made resources under code

  Recommended

  Import every resource that was made by hand into code before you change it. Then tag everything the code manages, so the rest stands out.