Home / Knowledge hub / Infrastructure as code
Knowledge hub
Infrastructure as code
Describing servers and networks in files so they can be reviewed and repeated.
What it means
Infrastructure as code, often shortened to IaC, means describing your servers, networks, databases and permissions in text files instead of clicking through a console. Tools such as Terraform, CloudFormation and Pulumi read those files and create the matching resources.
The files live in version control like any other code. That gives you history, review and the ability to rebuild an environment from scratch with the same result each time.
Why it matters
Written down, your setup can be reviewed before it goes live, and a wrong setting can be caught in a pull request rather than discovered by a stranger. Repeatability also reduces the drift between test and production that causes surprise exposure.
The same power works in reverse. A single insecure line is applied everywhere the file is used, and an attacker who can change the files or the pipeline that runs them can change your entire environment. The code is as sensitive as the systems it creates.
How it shows up
You meet it as repositories of configuration files and the pipeline that applies them. Typical problems are secrets written into files or state, storage and ports opened too widely, permissions copied from examples, and pipelines that run with administrator rights.
Review infrastructure changes like application code, scan the files for known risky settings before applying, protect the repository and pipeline, keep secrets out of the files, and watch for drift between the code and what is running. See Terraform misconfiguration and secrets management.
Questions people ask
Infrastructure as code, answered
Is infrastructure as code more secure than manual setup?
It can be, because changes are reviewed and repeatable. It can also spread mistakes faster. The gain comes from the review and checking you build around it.
Can IaC files contain secrets?
They can, and that is a mistake. Passwords and keys written in files end up in version control history. Use a secrets manager and refer to the secret instead.
What is drift?
Drift is when the running environment no longer matches the code, usually because someone changed it by hand. It hides risky settings from review.
What tools check IaC for problems?
Static analysis tools read the files and flag risky settings, such as public storage or open ports. They work before deployment and complement checks on the live environment.
Does it protect the application?
No. It secures how the infrastructure is set up. The application on top still needs its own testing for flaws in code and logic.
Sources
Where this comes from
Related
Terms that sit next to this one
Terraform misconfiguration
An insecure setting written into infrastructure code and then deployed at scale.
Infrastructure drift
Live systems slowly differing from what your code says they should be.
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
DevSecOps
Making security a shared, automated part of development and operations.
Policy as code
Writing access rules as versioned, testable code instead of settings clicked by hand.
Is your setup reviewed like code?
Infrastructure code decides what your application is exposed to. We test the running application and show what a stranger can reach, with evidence for each finding. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.