What Is Infrastructure as Code (IaC)? A Plain-English Guide

Picture the server that runs your most important app. Who set it up? Which settings did they change? If it disappeared tonight, how long would it take to build an identical one?

For many companies, the honest answers are “someone who left,” “nobody is sure” and “days.” Infrastructure as code (IaC) exists to fix exactly that. It turns the setup of your servers, networks and cloud services into files that anyone on the team can read, review and run again.

What infrastructure as code means

AWS describes IaC as the ability to provision and support your computing infrastructure using code instead of manual processes. Microsoft’s definition adds the important part: just as the same source code always produces the same program, an IaC model produces the same environment every time it is deployed.

In practice, you write a file that says something like “I need 1 virtual network, 2 web servers of this size, a managed database and a firewall rule that allows HTTPS.” An IaC tool reads the file, compares it with what already exists and makes the real infrastructure match.

Here is a small, simplified example in Terraform’s configuration language:

``` resource “aws_s3_bucket” “invoices” { bucket = “example-co-invoices”

tags = { team = “finance” environment = “production” } } ```

Those few lines describe a storage bucket and its labels. Nobody has to remember which boxes to tick in a web console, because the file is the record.

The problem IaC solves: snowflake servers

Microsoft’s documentation explains that IaC grew out of the problem of environment drift. When people configure environments by hand, each one slowly becomes a “snowflake”: a unique setup that cannot be reproduced automatically.

You have probably seen the symptoms:

• The app works in testing but breaks in production, and nobody can find the difference.
• A security setting was changed during an emergency and never changed back.
• Only 1 person knows how the mail server or VPN was built.
• Building a new environment for a client or a new region takes weeks.

Manual setup is not wrong because people are careless. It is fragile because humans are not designed to repeat 200 clicks identically every time.

3 reasons IaC matters: consistency, review and recovery

Consistency

Because the same file builds every environment, development, testing and production can match by design. You can still vary sizes or counts with variables, but the structure stays the same. Microsoft highlights idempotence as a core principle: running the same deployment again leaves the environment in the same state, regardless of where it started.

Review

IaC files live in version control, usually Git, next to your application code. That changes how infrastructure decisions get made:

• Every change is a proposed edit that a colleague can review before it goes live.
• You get a full history of who changed what, when and why.
• Tools such as Terraform show a plan first, listing exactly what will be created, changed or destroyed, so reviewers see the impact before approving it.
• Security and compliance checks can scan the files automatically, catching problems such as public storage buckets before they exist.

For teams working toward audits such as SOC 2, that change history is valuable evidence. See our SOC 2 compliance guide for how auditors look at change management.

Recovery

This is the benefit owners feel most. If a region fails, an account is compromised or someone deletes the wrong thing, you can rebuild the infrastructure from code instead of from memory. AWS notes that IaC lets you duplicate an environment elsewhere and roll back to a previous working version.

IaC rebuilds the infrastructure, not your data. You still need backups for databases and files. But the slow, error-prone part of recovery, recreating networks, servers, permissions and settings, becomes a repeatable command. That makes IaC a natural partner to a plan for ransomware protection.

Key takeaway: IaC turns “how our infrastructure is built” from tribal knowledge into a reviewed, versioned file. That single change improves consistency, makes audits easier and can cut recovery time from days to hours.

Declarative vs imperative IaC

There are 2 broad styles.

• Declarative files describe the end state you want (“3 servers behind a load balancer”), and the tool works out the steps. AWS notes this is simpler when you already know which components you need. Terraform, CloudFormation and Bicep are mostly declarative.
• Imperative code lists the steps to take, in order. It gives more control but is harder to maintain. Microsoft recommends declarative definitions where possible, partly to avoid the technical debt of long deployment scripts.

A related split is between provisioning tools, which create cloud resources, and configuration management tools, which set up software inside servers. Many teams use one of each.

Common IaC tools compared

A note on licensing: HashiCorp moved Terraform from the Mozilla Public License to the Business Source License in August 2023, and IBM completed its acquisition of HashiCorp in February 2025. In response to the license change, a group of companies created OpenTofu, a fork that now runs under the Linux Foundation and describes itself as a drop-in replacement for Terraform. For most businesses using Terraform internally, the license change has little practical effect, but it matters if you build a product on top of it. This is not legal advice.

How IaC fits into a delivery pipeline

IaC works best when changes flow through the same pipeline as application code:

1. An engineer edits an IaC file on a branch.
2. The pipeline checks formatting, runs security scans and produces a plan.
3. A reviewer reads the plan and approves the change.
4. The pipeline applies it, first to a test environment, then to production.
5. A scheduled job checks for drift, where someone changed a resource by hand, and flags it.

This is the heart of the “ops” half of DevOps. It also makes it practical to run containers on virtual machines at scale, because the hosts, clusters and networks are all defined the same way. Many companies wrap these pipelines in an internal developer platform, described in our guide to platform engineering.

Common mistakes to avoid

• Storing secrets in IaC files. Passwords and keys belong in a secrets manager, not in Git.
• Losing the state file. Tools such as Terraform track what they manage in a state file that Terraform calls its source of truth. Keep it in secure, backed-up remote storage with locking, never on a laptop.
• Mixing manual and coded changes. If people keep clicking in the console, the code stops being the truth. Agree that every change goes through code.
• Trying to code everything at once. Start with new resources and import old ones gradually.
• Skipping review. IaC can delete as fast as it creates. Always read the plan before applying.

Where to start

You do not need a big project. Try these 5 steps over a few weeks:

1. Pick 1 tool. If you use a single cloud, its native tool is the simplest start. If you use several, Terraform or OpenTofu is the common choice.
2. Choose a low-risk target, such as a new test environment, a storage bucket or a DNS zone.
3. Put the files in Git and require a second person to approve changes.
4. Set up remote state with access controls and backups.
5. Run it from a pipeline, not a laptop, so every change is logged. Then expand to production resources one service at a time.

If no one on your team has done this before, the skills overlap heavily with those in our guide on how to become a DevOps engineer.

The bottom line

Infrastructure as code replaces hand-built, hard-to-repeat setups with files that describe your environment exactly. The payoff comes in 3 forms: environments that match, changes that get reviewed before they go live, and the ability to rebuild quickly when something goes wrong. Start with 1 small, low-risk piece of infrastructure, put it in version control and grow from there.

Sources

• Microsoft Learn: What is infrastructure as code? — definition, environment drift, idempotence, declarative files
• AWS: What is infrastructure as code? — definition, benefits, declarative vs imperative approaches
• HashiCorp Developer: What is Terraform? — write, plan, apply workflow and state
• OpenTofu — Linux Foundation stewardship and drop-in replacement for Terraform