Infrastructure as code (IaC) is the practice of defining and managing computing infrastructure in code or configuration files, instead of configuring it by hand through a console or user interface. Tools read those files and provision or update the resources they describe, so the setup becomes repeatable, reviewable and versioned like application code.
The definition, in the vendors’ own words
The major platform vendors phrase it slightly differently, but they agree on the core idea.
As an Amazon Associate I earn from qualifying purchases.
- HashiCorp’s Terraform glossary: “Infrastructure-as-Code (IaC) is the practice of managing infrastructure in a file or files rather than manually configuring it via a user interface.”
- HashiCorp’s IaC guidance describes version-controlled specifications that people can review, test and automate. The configuration describes the desired infrastructure state, and tools create, modify or manage resources to match it.
- AWS defines it as provisioning and managing application infrastructure through configuration files.
- Microsoft Learn describes a versioned, descriptive model used to define and deploy things such as networks, virtual machines, load balancers and connection topologies.
Taken together, the definition is not tied to one tool, one language, or the public cloud. Terraform, CloudFormation and Bicep are implementations of the practice, not the practice itself.
What counts as “infrastructure”
Infrastructure here means the resources an application runs on: compute (such as virtual machines), networks and subnets, load balancers, storage, operating-system configuration, and supporting services. The boundary depends on the system. AWS’s guidance treats serverless services, queues and workflow components as infrastructure too, since they are provisioned and configured as resources.
#1 Best Overall
How infrastructure as code works
- Describe. Write a definition of the resources and their settings: for example a network, a subnet, a compute instance and a storage bucket. HashiCorp’s own example expresses exactly this in its HCL language.
- Version. Store the files in version control, so every change has history, an author and a review trail.
- Review and validate. Teammates review changes as they would application code. AWS notes that code can be scanned before deployment, and testing can happen before anything is created.
- Apply. An IaC tool, often run from a CI/CD pipeline, compares the definition with the target environment and creates or changes resources to match. In Terraform, providers talk to platform APIs, and state tracks what has been created so the tool can work out dependency order.
- Change by editing the source. To alter an environment, you edit the definition and deploy again, rather than modifying each server or setting individually.
Declarative versus imperative IaC
| Approach | You write | Strength | Cost |
|---|---|---|---|
| Declarative | The components and configuration you want; the tool works out how to reach that state | Abstracts away execution details; often preferred where the tool supports it | Less direct control over the order of operations |
| Imperative | The ordered steps for creating or configuring resources | Useful when sequencing or complex procedural logic matters | More procedural detail to write and maintain |
The two are not mutually exclusive. AWS CDK, for instance, lets you write in a general-purpose programming language (code-first) and synthesizes CloudFormation templates, which are declarative. There is also no standard declarative syntax: Microsoft lists YAML, JSON and XML as platform-dependent formats, and names Azure Resource Manager templates and Bicep as Azure options.
Idempotence and drift
Two concepts come up constantly. Idempotence, as Microsoft describes it, means a deployment operation should converge on the same configuration regardless of the target’s starting state: run it on an empty environment or a half-configured one and you end up with the same result. Configuration drift is when environments diverge because of manual, ad hoc changes. IaC addresses drift by making the source definition the place where changes are made and redeployed.
Both are goals that depend on well-written definitions and a disciplined workflow. They are not automatic properties of every command in every tool.
Benefits and limits
- History and review: version control and code review apply to infrastructure changes.
- Repeatable environments: the same definition can create development, test and production setups.
- Automation: deployments can run through CI/CD pipelines, with testing before deployment.
- Living documentation: the definitions record what is supposed to exist.
- Limits: IaC does not by itself guarantee security, compliance, consistency or error-free changes. A bad definition is applied just as faithfully as a good one, and drift can still occur if people keep changing resources outside the code.
Common tools
These are examples of the category, not a ranking.
| Tool | What it is |
|---|---|
| Terraform | Provider-based tool using HCL and state; works with cloud providers and services in its provider ecosystem, and with systems that expose an API (per HashiCorp) |
| AWS CloudFormation | AWS service for modeling and provisioning infrastructure from templates |
| AWS CDK | Code-first toolkit using programming languages; synthesizes CloudFormation templates |
| AWS SAM | AWS option oriented to serverless application resources |
| Pulumi | One of the options AWS compares for provisioning on AWS |
| Azure Resource Manager templates and Bicep | Azure-native options named by Microsoft |
Choosing a tool
AWS’s guidance is explicit that there is no one-size-fits-all tool. Useful questions to ask:
Rank #3
- Which platforms and providers must it support, and how complete is its resource coverage?
- Do you prefer declarative templates or a code-first approach, and what languages does the team already know?
- How does it handle planning, review and testing before changes are applied?
- How is state stored and shared between collaborators?
- Does it fit your existing CI/CD and policy processes, and how much control over resources do you need?
Tool features change, so check current documentation before committing to one.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
