What Is Infrastructure as Code (IaC)?

Quick answer
Infrastructure as code (IaC) manages servers, networks, and databases with versioned config files instead of manual console clicks.
The two styles are declarative (you state the desired result) and imperative (you state the steps).
IaC makes infrastructure reviewable, repeatable, and reversible — the same benefits source control gives application code.

What is infrastructure as code?

Infrastructure as code is the practice of describing computing resources — virtual machines, networks, databases, load balancers — in machine-readable files that tools then apply. Instead of clicking through a cloud console, you write a definition, commit it, and let a tool create and update the resources to match. The files live in version control, so every change has a history, an author, and a review.

How does IaC work?

An IaC tool reads your configuration, compares it with the live environment (its state), and issues the API calls needed to reconcile the two. Declarative tools such as Terraform and Pulumi let you say “I want a virtual machine with this size in this region” and figure out the steps. Imperative tools such as Ansible describe the exact sequence of commands to run. The tool records what it created in a state file so later runs know what changed.

Why does IaC matter?

IaC removes the “works in my account, not in yours” problem by making environments reproducible. It also reduces risk: a proposed change can be reviewed in a pull request, and a bad one can be reverted by reverting the commit. This is the foundation that GitOps and platform engineering build on.

Where this bites vibecoders
The dangerous moment is when an AI assistant generates Terraform for a real cloud account. It may produce a config that looks right but lacks the guards an experienced operator adds — like prevent_destroy on databases, or a correct state-file setup. The result is a config that can delete production data with a single apply. See Why Did My AI-Generated Terraform Config Almost Delete Production?.

Where AI coding assistants get this wrong

Generating destroy-prone configs with no lifecycle protection on data stores.
Mixing hardcoded secrets into resource definitions instead of using variables and a secret store.
Producing imperative console commands and calling it IaC, leaving no state to reconcile against.
Creating resources in the wrong order or region because it didn’t model dependencies correctly.

Checklist

Version every infrastructure change in Git and review it like code.
Use variables and secret references, never plaintext credentials in IaC files.
Protect data stores with prevent_destroy or the tool’s equivalent.
Run a plan (or dry run) and read it before every apply.
Keep the state file somewhere secure and shared, with backups.

FAQ

What is the difference between declarative and imperative IaC?

Declarative describes the desired end state and lets the tool compute the steps; imperative describes the steps themselves. Terraform and Pulumi are primarily declarative, while Ansible is imperative. Declarative tools generally handle drift and convergence better.

Is IaC only for the cloud?

No. IaC works for on-premises servers, DNS, and even SaaS configuration. The idea is the same: describe the desired state in code and reconcile against it.

What is a state file?

A state file records which resources the tool manages and their current attributes, so the next run knows what to create, update, or delete. Treat it as sensitive: it can contain resource details, and losing it makes your infrastructure harder to manage.