Why infrastructure as code

Clicking through a cloud console works for one experiment. It fails as soon as you need to answer simple questions: what exactly is running in production, who changed that security group, and can we create the same setup for a new customer?

Infrastructure as code (IaC) answers them by describing infrastructure in text files:

• Reviewable: changes go through pull requests like application code.
• Repeatable: the same code creates staging and production consistently.
• Documented: the code is the documentation of what exists and why.
• Recoverable: if something is deleted, you can recreate it.

Declarative

Terraform and OpenTofu are declarative. You describe the end state, and the tool works out the steps:

resource "aws_s3_bucket" "reports" {
  bucket = "acme-reports-prod-example"
  tags = {
    team = "analytics"
  }
}

This says "a bucket with this name and tags should exist". The tool compares that with reality and creates, updates or deletes resources to match.

The core workflow

terraform init      # download providers, configure the backend
terraform plan      # show what would change
terraform apply     # make the changes, after confirmation
terraform destroy   # remove everything this configuration manages

The plan is the heart of safe IaC. It lists every resource to be created (+), updated in place (~), replaced (-/+) or destroyed (-). Learning to read plans carefully is the most important skill in this course.

Providers

Terraform itself knows nothing about AWS or GitHub. Providers are plugins that translate resources into API calls. There are providers for every major cloud, plus DNS services, monitoring tools, GitHub, Kubernetes and many more. Both Terraform and OpenTofu use their own registries but support the same provider ecosystem.

What IaC does not solve

IaC does not make bad architecture good, it does not prevent people from changing things in the console (we will detect that drift later), and it introduces a new critical asset: the state file. We start with state in the next lessons, because most serious Terraform incidents involve it.