Revision · Infrastructure as Code

This part took the book’s core move — stop doing it by hand — one layer below the application and applied it to the platform itself. The throughline: infrastructure becomes text, a repo becomes the source of truth, and a tool reconciles reality to match.

What this part covered

• Why IaC — describe infrastructure in version-controlled files so you inherit Git’s review, history, blame, rollback, and branching, and can rebuild an entire environment on demand instead of from memory.
• ClickOps is the enemy — building from a console leaves knowledge in one person’s head, lets staging and prod quietly drift, and turns disaster recovery into “remember every checkbox under pressure.”
• Declarative over imperative — describe the desired end-state and let a reconciler compute the delta, rather than scripting steps that rot because they must be correct for every possible starting state.
• Idempotent and convergent — a declarative run produces the same result whether applied once or ten times, and drives toward the declared state from wherever reality currently is.
• Terraform — a provider-agnostic engine where you write HCL resources, a dependency graph derives the order, and terraform plan shows a +/~/- diff before apply touches anything.
• State and drift — the state file maps each resource to its real-world identity, and running plan diffs code, last-known state, and live reality, making it a standing drift detector when run on a schedule.
• Remote state and locking — shared backends (S3, HCP Terraform) hold the authoritative state and serialize applies with locks so concurrent runs can’t corrupt it.
• Configuration management (Ansible) — provisioning a server and configuring what runs on it are different layers; agentless, push-based, idempotent playbooks bring every host in a group to the same declared spec over SSH.
• Immutable infrastructure — treat servers as cattle, bake a golden image with a tool like Packer, and ship change by replacing the fleet — which makes drift structurally impossible and rollback a matter of redeploying the previous image.

The takeaway

The manual step IaC removes is building and changing infrastructure from human memory and clicks; the safety dividend is a platform that is rebuildable, reviewable, and provably identical to staging every time. This same reconcile-to-declared-state pattern powers Kubernetes and GitOps — and the cloud that hosts all of it is only manageable when driven this way, which is exactly where the next part picks up.