Infrastructure as Code (IaC) is one of the most widely adopted practices in modern operations. It is also one of the most widely misunderstood. The misunderstanding is simple: organizations focus on the code and neglect the discipline.
The code is the easy part. Writing Terraform modules, Ansible playbooks, or Kubernetes manifests is a technical skill that any competent engineer can acquire. The difficult part—the part that determines whether IaC delivers value—is the organizational commitment to the principle that infrastructure changes go through the same review, testing, and deployment pipeline as application code.
Where IaC breaks down. The most common failure mode is drift: production infrastructure diverges from the codebase because someone made a manual change during an incident. The second most common is unreviewed changes: someone merges a Terraform PR that modifies production security groups without a security review because the CI pipeline approved it automatically. The third is stale state: the IaC state file no longer reflects production because it was not updated after a manual remediation.
The discipline of immutable infrastructure. The principle is simple: every change to production infrastructure must go through the code pipeline. No exceptions. Not during incidents (use the pipeline for emergency changes with abbreviated review), not during migrations (use the pipeline to provision new infrastructure alongside old), not during debugging (use read-only access, never write access to production resources). This principle is easy to state and hard to enforce because it requires cultural change, not just tooling.
Procurement relevance. Government infrastructure procurement—whether through TED for EU systems or SAM.gov for US federal systems—increasingly specifies IaC requirements. Tenders ask for infrastructure definitions in code, version-controlled and auditable. This is not just a technical preference; it is an accountability requirement. When infrastructure changes are in code, every change is documented, reviewable, and reversible. When infrastructure is managed through console clicks, changes are invisible and irreversible.
IaC that works is IaC where the code is the source of truth and the pipeline is the only path to production. Everything else is IaC theater—code that documents what the infrastructure should look like, while the actual infrastructure drifts further away with each manual change.