In short IaC (infrastructure as code) means managing servers, networks and settings through code in files rather than by hand over SSH. The file lives in git: it shows up in history, can be reviewed, rolled back, and applied identically to one machine or a thousand.
The problem IaC solves
Manual setup ("log in, install, tweak the config") doesn't scale and can't be reproduced: across a hundred servers the settings drift apart (configuration drift), no one remembers what was changed where, and a new server is stood up from memory and with mistakes. IaC describes the desired state as code — and that state is applied automatically and identically everywhere.
Analogy: a recipe versus cooking by eye. One portion by eye is fine. A hundred identical portions only work from a precise recipe — one you can also hand over, review and fix.
Key ideas
- Declarative vs imperative. Imperative — you list the steps: "install X, start Y." Declarative (the usual IaC approach) — you describe the desired state: "X must be installed, Y running," and the tool works out how to get there from the current one.
- Idempotence. Apply the description once or ten times — the result is the same. The tool changes only what differs from the desired state; a re-run breaks nothing. That makes applying safe and predictable.
- Provisioning vs configuration management. Provisioning (create) — stand up the infrastructure itself: servers, networks, disks (tool — Terraform). Configuration management (set up) — bring existing machines to the wanted shape: packages, configs, services (Ansible, Chef, Puppet).
- Versioning. IaC files live in git: full history of who changed what, reviewable and revertible — like ordinary code.
Security of IaC
IaC is both a defence tool and a new attack surface.
⚠️ Risks
- Secrets in code — passwords and keys must never sit in IaC files: they leak into git history. Use secret stores (Vault, CI secrets) and inject them at apply time.
- State files — Terraform keeps state (
terraform.tfstate) with sensitive data: protect it, don't commit it. - A bug in the code = a bug on every machine at once — the flip side of sameness.
✅ Wins for defence
- Reproducibility — wipe a compromised server and rebuild it from clean code: fast recovery after an incident.
- Auditability — the whole configuration is code under review; you can see what's set and check it against policy.
- Uniformity — no "forgotten server" with an old hole: everything is brought to one state.
Related
The source is the Intro to IaC room. The scripts IaC often runs are in bash scripting basics; why to describe infrastructure honestly is in threat modeling.