---
title: "Infrastructure as code · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Infrastructure as code

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Create every resource from code in version control. Keep state locked and encrypted, review each plan, apply only from CI and catch drift daily.

Infrastructure as code means a file describes each server, database, network and DNS record. A tool compares the file with what exists and makes the difference. The examples use OpenTofu and Terraform, which share one language. Pulumi, AWS CloudFormation, Azure Bicep and Google's Config Connector follow the same rules.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code`.

## Required

- [Define every resource in code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/define-infrastructure-in-code): Create and change every cloud resource, firewall rule and DNS record through code in version control. Never make a lasting change in a web console.
- [Keep state remote with locking and encryption](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/remote-state): Keep the state file in a remote backend that locks, encrypts and keeps old versions. Only the deploy roles may read it. Never keep state in git or on a laptop.
- [Review the plan and apply only from CI](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/plan-in-review): Post the plan in every pull request. Apply only from CI after merge, from the plan file made for that commit. No person applies from a laptop.
- [Pin the tool and provider versions](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/pinned-provider-versions): Pin the version of the tool and of every provider, and commit the provider lock file with hashes for every platform you run on.
- [Detect drift every day](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/drift-detection): Run a plan against every state at least once a day. Open a ticket when it finds a change nobody made in code.
- [Protect resources that hold data](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/protect-stateful-resources): Turn on deletion protection for every database, bucket and disk that holds data. Stop any plan that deletes or replaces one until a second person approves.

## Recommended

- [Split state by environment and layer](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/split-state): Give each environment and each layer its own state, such as network, data and app. One mistake then touches only one of them.
- [Reuse versioned modules](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/versioned-modules): Put each repeated pattern in a module with checked inputs, and pin every use of it to a version. Never copy the same resources between environments.
- [Bring hand-made resources under code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/import-existing-resources): Import every resource that was made by hand into code before you change it. Then tag everything the code manages, so the rest stands out.

- Next: [Environments](https://agentwranglers.se/playbook/infrastructure/environments)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)