📚 Chapter 13: Infrastructure as Code (IaC) Maturity

1. Core Principles and Benefits of IaC

A. The Definition

• Idempotency: Applying IaC multiple times yields the same final state.
• Declarative vs Imperative: Declarative (Terraform, CloudFormation) describes desired state; Imperative (Ansible, shell) specifies steps.

B. Architectural Benefits

1. Repeatability: Identical environments reduce config drift and “works on my machine”.
2. Auditability: Changes reviewed and logged via Git.
3. Disaster Recovery: Rebuild environments from code definitions quickly.

2. Terraform and CloudFormation

A. Key Difference: Abstraction

• Terraform: Multi-cloud via providers (HCL) across AWS/Azure/GCP/K8s.
• CloudFormation: AWS-native with strong dependency mgmt and rollback in AWS.

B. State Management (Architect’s Concern)

• State File: Maps code to real resources; must be secure and highly available.
• Maturity Requirement: Store state in remote backends (S3/Blob) with locking and access controls.

3. IaC Maturity and GitOps

GitOps: Operational model applying IaC best practices to CD and orchestration (esp. Kubernetes).

A. GitOps Principles

• Declarative: System described in Git.
• Versioned & Immutable: Git is the source of truth; changes via commits.
• Pulled, Not Pushed: In-cluster agents (ArgoCD/Flux) pull and reconcile desired state.

B. Benefits of GitOps Maturity

• Enhanced Security: CI servers don’t need prod credentials; reduced blast radius.
• Self-Healing: Detects drift and reconciles to desired configuration.
• Repeatable Rollbacks: Revert to previous state via Git commit history.

4. Security and Governance in IaC

• Policy as Code (PaC): Use OPA/Rego or Sentinel to enforce rules pre-deploy.
• Secret Management: Integrate with Vault/Secrets Manager; never commit secrets to Git.
• Drift Detection: Scan live infra; compare with IaC state to catch manual changes.