We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Cloud Infrastructure
Managing servers, networks, and cloud resources through declarative configuration files instead of manual setup. Terraform, Pulumi, and CloudFormation are IaC tools.
In short
Infrastructure as Code (IaC) is the practice of defining servers, networks, databases, and other cloud resources in machine-readable configuration files that a tool reads and applies automatically, instead of clicking through a console or running commands by hand. Tools like Terraform, Pulumi, and AWS CloudFormation read these files and create, change, or destroy real infrastructure to match what the files describe.
In short
Infrastructure as Code (IaC) is the practice of defining servers, networks, databases, and other cloud resources in machine-readable configuration files that a tool reads and applies automatically, instead of clicking through a console or running commands by hand. Tools like Terraform, Pulumi, and AWS CloudFormation read these files and create, change, or destroy real infrastructure to match what the files describe.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers Infrastructure as Code across a run of lessons, not one page. These 4 alone are about 81 minutes of step-by-step reading, every one with a quiz.
Defining servers, networks, databases, and cloud resources in declarative code files instead of clicking through consoles.
Define infrastructure in version-controlled code. Terraform, Pulumi, and reproducible environments.
Managing application and infrastructure configuration in version-controlled files instead of manual settings.
Defining what your infrastructure should look like and letting systems converge toward it automatically.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Infrastructure as Code (IaC)pay once,
yours for life
Before IaC, you provisioned infrastructure by logging into a cloud console and clicking buttons, or by SSHing into a server and running setup commands. That works once. The problem is repeating it. Six months later nobody remembers the exact 40 steps, the staging environment drifts away from production, and rebuilding after an outage takes a frantic afternoon of guessing.
IaC fixes this by putting the whole environment in text files that live in Git next to your application code. A file might say: one VPC, three subnets, an autoscaling group of five t3.medium instances, a Postgres database with 100 GB of storage, and a load balancer in front. You commit it, review it like any other code, and a tool turns it into reality.
Most modern IaC is declarative. You describe the end state you want, not the steps to get there. The tool figures out the difference between what exists and what you asked for, then makes only the changes needed. This is different from a shell script, which runs the same commands every time whether or not they are needed.
A declarative tool keeps a record of what it believes already exists, called state. Terraform stores this in a terraform.tfstate file, usually kept in an S3 bucket or Terraform Cloud rather than on a laptop. When you run a plan, the tool compares three things: the desired state in your files, the recorded state, and the live state queried from the cloud API.
From that comparison it builds an execution plan: create these two resources, modify that one, delete this orphan. You review the plan, approve it, and the tool calls the provider APIs (AWS, GCP, Azure, Cloudflare, and so on) in dependency order. It knows the database must exist before the app that connects to it, so it builds a graph and walks it.
Idempotency is the key property. Running apply twice with no file changes produces zero changes the second time, because the live state already matches. This is what makes IaC safe to run repeatedly and safe to automate inside a CI/CD pipeline.
Pulumi works the same way but lets you write the definitions in TypeScript, Python, Go, or C# instead of a custom language, so you get loops, functions, and real package management. CloudFormation and Azure Bicep are the cloud-vendor-native equivalents, scoped to one provider.
Use IaC the moment you have more than one environment, more than one engineer, or anything you would hate to rebuild from memory. It gives you repeatable environments, code review on infrastructure changes, a Git history of who changed what, and disaster recovery that is a single apply away. Spinning up an identical staging copy becomes a one-line change instead of a day of clicking.
The costs are real. There is a learning curve, the state file becomes a critical artifact you must back up and lock so two people do not apply at once, and a careless plan can propose deleting your production database. Always read the plan before approving. Drift is the other trap: if someone makes a manual change in the console, the live state no longer matches your files, and the next apply may revert it.
IaC handles provisioning, which is creating the infrastructure. It is usually paired with configuration management tools like Ansible or with container orchestration like Kubernetes, which handle what runs inside the machines once they exist. The common pattern is Terraform to build the cluster, then Helm or Kubernetes manifests to deploy apps onto it.
Say a team launches a new region for their product. With IaC, they copy the existing region module, change a few variables (region name, CIDR block, instance count), and run terraform plan. The plan shows 60 resources to add. They review it, run apply, and 8 minutes later the new region has the same network layout, the same security groups, the same database configuration, and the same monitoring as the original. No step was forgotten because every step lives in the file.
Six months on, an engineer needs to bump every web server from 5 instances to 8 and add a read replica to the database. That is a three-line diff in a pull request. A teammate reviews it, CI runs the plan automatically and posts it as a comment, and after approval the pipeline applies it. The change is documented, reversible, and applied identically across every environment that uses the module.
HashiCorp Terraform
The most widely used IaC tool, cloud-agnostic, with thousands of providers covering AWS, GCP, Azure, Cloudflare, Datadog, and more.
Amazon Web Services
Ships CloudFormation and the CDK as native IaC; most large AWS shops define their entire account footprint as code.
Netflix
Provisions its huge AWS footprint through IaC and automation so thousands of instances can be created and replaced without manual setup.
Kubernetes
Its YAML manifests are declarative infrastructure for workloads; tools like Helm and Crossplane extend the IaC model to cluster resources.
IaC such as Terraform provisions the infrastructure itself: the VMs, networks, load balancers, and databases. Configuration management such as Ansible, Chef, or Puppet sets up what runs inside those machines, like installing packages and writing config files. They are complementary and teams often use both, IaC first to build the box, then config management to set it up.
Declarative means you describe the desired end state and the tool computes the steps to reach it (Terraform, CloudFormation). Imperative means you write the exact ordered commands to run, like a shell script. Declarative is preferred because it is idempotent and handles updates automatically, while imperative scripts can break when run against an environment that is partially set up.
The state file is Terraform's record of which real resources it manages and their current attributes. It is how the tool knows what already exists so it only changes what is needed. It is sensitive and critical, so it should be stored remotely (such as in an S3 bucket or Terraform Cloud) with locking enabled, never committed to Git, and backed up.
Drift happens when someone changes infrastructure manually, for example tweaking a security group in the cloud console, so the live state no longer matches the IaC files. The next plan will detect the difference and may try to undo the manual change. The fix is to make all changes through code and to run regular drift detection so surprises do not pile up.
The Terraform CLI is open source and free to use. HashiCorp sells Terraform Cloud and Terraform Enterprise for teams that want hosted state, run automation, policy enforcement, and collaboration features. Open-source alternatives like OpenTofu, a community fork of Terraform, are also fully free.
Terraform
An open-source IaC tool by HashiCorp that provisions infrastructure across any cloud provider using declarative HCL configuration. Plan, apply, destroy.
Ansible
An agentless automation tool for configuration management, application deployment, and orchestration. Uses YAML playbooks and connects over SSH.
GitOps
Using Git as the single source of truth for infrastructure and application configuration. Changes are made via pull requests and automatically reconciled by tools like ArgoCD or Flux.
Virtual Machine
A software emulation of a physical computer running its own OS on shared hardware. Heavier than containers but provides stronger isolation.
Hypervisor
Software that creates and manages virtual machines by abstracting physical hardware. Type 1 (bare-metal) runs directly on hardware; Type 2 runs on an OS.
Cloud Region
A geographic area containing one or more data centers (availability zones). Choosing the right region reduces latency and satisfies data residency requirements.
This page explains the idea. The "Infrastructure as Code (IaC)" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Infrastructure as Code (IaC) lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about Infrastructure as Code in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
