13. Infrastructure as Code

Declare, don't click

IaC describes the desired infrastructure in version-controlled files and lets a tool compute the diff. Terraform and OpenTofu are provider-agnostic; CloudFormation, Bicep and Deployment Manager are native; Pulumi and CDK use general-purpose languages.

State and drift

Terraform records reality in a state file that must live in shared, locked remote storage — never on a laptop. Manual console changes create drift; detect it with a scheduled plan and treat any surprise diff as an incident in an environment that matters.

Structure and safety

Split by environment and blast radius, keep reusable modules versioned, and run plan on pull requests with apply gated behind review. Policy-as-code (OPA, Sentinel, tfsec/Checkov) blocks public buckets and open security groups before they exist.

resource "aws_s3_bucket" "artifacts" {
  bucket = "solforge-artifacts-${var.env}"
}

resource "aws_s3_bucket_public_access_block" "artifacts" {
  bucket                  = aws_s3_bucket.artifacts.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}