Why Infrastructure as Code
Describe your infrastructure in files so it is versioned, reviewable, and reproducible.
Infrastructure as Code (IaC) means defining your AWS resources — networks, servers, databases, permissions — in text files instead of clicking through the console. Those files live in Git alongside your app.
Why it wins
- Repeatable — spin up an identical stack for dev, stage, and prod.
- Reviewable — changes go through pull requests.
- Recoverable — recreate everything after a disaster.
- No drift — the files are the single source of truth.
Example
# IaC turns infrastructure into a git-tracked, reviewable artifact
git add infra/template.yaml
git commit -m "Add ECS service + ALB to prod stack"
# ...opens a pull request that a teammate reviews before it shipsWhen to use it
- A team stores their VPC, subnets, and security groups as CloudFormation templates in Git so every change is reviewed in a pull request before being applied.
- An ops engineer re-creates a failed production environment in minutes by re-running the IaC template instead of manually clicking through the console.
- A company enforces that no AWS resource is created outside of IaC by using Service Control Policies, preventing drift from the defined state.
More examples
Check for infrastructure drift
Triggers drift detection on a CloudFormation stack to find resources that were changed outside of IaC.
# Detect drift between CloudFormation template and live resources
aws cloudformation detect-stack-drift \
--stack-name my-prod-stack
# Poll for drift detection result
aws cloudformation describe-stack-drift-detection-status \
--stack-drift-detection-id <detection-id>Terraform plan before any change
Runs terraform plan to show exactly what will be created, changed, or destroyed before touching real infrastructure.
cd infra/
terraform init
terraform plan -out=tfplan
# Review the plan output before applyingEnforce IaC via pre-commit hook
A pre-commit hook validates Terraform configs whenever infra files are staged, preventing broken IaC from being committed.
#!/bin/bash
# .git/hooks/pre-commit
# Block commits that modify AWS console-only resources
if git diff --cached --name-only | grep -q 'infra/'; then
echo 'IaC change detected — running terraform validate'
cd infra && terraform validate
fi
Discussion