Infrastructure as Code (IaC) is the practice of defining, provisioning, and managing cloud and on-premises infrastructure through machine-readable configuration files rather than manual processes or interactive console clicks. IaC treats infrastructure the same way software teams treat application code: it is version-controlled, reviewed through pull requests, tested in CI pipelines, and deployed through automated workflows.
According to the 2025 HashiCorp State of Cloud Strategy Survey, 78% of organizations use IaC in production, up from 61% in 2023. IaC has moved from best practice to baseline expectation for professional engineering teams.
Why Does Infrastructure as Code Matter?
Before IaC, engineers provisioned servers by clicking through cloud provider consoles or running ad hoc scripts. This approach created three systemic problems:
IaC solves all three. Every change is tracked in version control, reviewed by peers, and reproducible by any team member. Disaster recovery becomes a matter of running a pipeline rather than reconstructing from scratch.
IaC Tool Comparison
The IaC ecosystem has matured into several categories. The right tool depends on your team's language preferences, cloud provider mix, and existing workflows.
| Tool | Language | Cloud Support | State Management | Learning Curve | License |
| Terraform | HCL (declarative) | All major clouds + 3000+ providers | Remote state (S3, GCS, Terraform Cloud) | Medium | BSL 1.1 |
| OpenTofu | HCL (declarative) | Same as Terraform | Same as Terraform | Medium | MPL 2.0 (open source) |
| Pulumi | TypeScript, Python, Go, C#, Java | All major clouds | Pulumi Cloud or self-managed | Low for devs (familiar languages) | Apache 2.0 |
| AWS CloudFormation | JSON/YAML (declarative) | AWS only | Managed by AWS | Medium | AWS service |
| Azure Bicep | Bicep DSL (declarative) | Azure only | Managed by Azure | Medium | MIT |
| Google Cloud Deployment Manager | YAML + Jinja2 | GCP only | Managed by GCP | Medium | GCP service |
| Crossplane | YAML (K8s-native) | Multi-cloud via providers | Kubernetes etcd | High | Apache 2.0 |
| CDK for Terraform (CDKTF) | TypeScript, Python, Go, C#, Java | All Terraform providers | Same as Terraform | Medium-High | MPL 2.0 |
Terraform remains the most widely adopted tool. The 2025 CNCF survey found that 62% of organizations using IaC chose Terraform or OpenTofu. Pulumi is the fastest-growing alternative, particularly among teams that prefer general-purpose programming languages over domain-specific ones.
How IaC Works: The Workflow
A typical IaC workflow follows five steps:
This workflow transforms infrastructure changes from high-risk manual operations into routine, auditable software deployments. Teams using this workflow report 75% fewer infrastructure incidents, according to Puppet's 2024 State of DevOps report.
Declarative vs. Imperative IaC
| Approach | How It Works | Example Tools | Best For |
| Declarative | Define desired end state; tool figures out how to get there | Terraform, CloudFormation, Bicep | Most infrastructure provisioning |
| Imperative | Write step-by-step instructions | Pulumi (when used imperatively), Ansible, custom scripts | Complex conditional logic, migrations |
Declarative IaC is preferred for most use cases because it is idempotent: running the same configuration twice produces the same result. Imperative approaches are useful when the order of operations matters or when complex business logic governs infrastructure decisions.
IaC Patterns and Best Practices
Module Pattern
Break infrastructure into reusable modules. A VPC module, a database module, and an application module can be composed independently. This reduces duplication and ensures consistency across environments.
Environment Promotion
Use the same IaC modules across development, staging, and production with environment-specific variable files. This guarantees that what you test in staging is what you deploy to production. Variable files contain only the differences: instance sizes, replica counts, and domain names.
State Isolation
Never share state files across unrelated projects. Use separate state backends (S3 buckets, GCS buckets) for each environment and each team. State file corruption or accidental deletion can orphan resources across your entire cloud account.
Policy as Code
Tools like OPA (Open Policy Agent), Sentinel (HashiCorp), and Checkov enforce rules on IaC configurations before they are applied. Common policies include: no public S3 buckets, all resources must have cost-allocation tags, no security groups with 0.0.0.0/0 ingress on port 22.
Drift Detection
Schedule regular plan runs (without applying) to detect configuration drift -- changes made outside IaC (e.g., through the cloud console). Drift should be treated as a bug: either import the change into IaC or revert it. Flexera reports that 47% of organizations experience drift-related incidents at least monthly.
IaC and Arxentra
Arxentra uses infrastructure as code internally to manage tenant namespaces, resource quotas, and service deployments. The ArxentraService CRD acts as a declarative specification that the Arxentra operator reconciles into Kubernetes resources. For teams adopting IaC alongside Arxentra, see our guide on cloud infrastructure management and our CI/CD pipeline setup.
Common IaC Mistakes
- Storing state locally -- Local state files get lost, corrupted, or conflict in team environments. Always use remote state with locking.
- Hardcoding values -- Use variables and data sources instead of hardcoding AMI IDs, IP addresses, or account numbers.
- No CI/CD pipeline -- Running terraform apply from a laptop bypasses code review and audit trails.
- Giant monolithic configurations -- Split infrastructure into small, independently deployable modules. A single state file with 500 resources takes minutes to plan and is risky to modify.
- Ignoring import -- Resources created manually should be imported into IaC, not recreated.
Frequently Asked Questions
What is the difference between Terraform and Pulumi?
Terraform uses HCL, a domain-specific language designed for infrastructure. Pulumi uses general-purpose programming languages (TypeScript, Python, Go, C#) to define infrastructure. Terraform has a larger ecosystem and more community modules. Pulumi is preferred by teams who want to use familiar programming constructs (loops, conditionals, functions) and share code between application and infrastructure.
Is CloudFormation still relevant in 2026?
Yes, for AWS-only organizations. CloudFormation offers the deepest AWS integration, supports every AWS service on launch day, and requires no external state management. However, multi-cloud organizations overwhelmingly choose Terraform or Pulumi for provider portability.
How do I migrate from manual infrastructure to IaC?
Start by importing existing resources into Terraform state using terraform import. Tools like Terraformer and Azure's export-template can generate initial configurations from existing cloud resources. Then iterate: clean up the generated code, add variables, and organize into modules. Most teams complete migration in two to four months depending on infrastructure complexity.
What is OpenTofu and should I use it?
OpenTofu is a community fork of Terraform created after HashiCorp changed Terraform's license from MPL 2.0 to BSL 1.1 in August 2023. OpenTofu is governed by the Linux Foundation and maintains compatibility with Terraform's HCL syntax and provider ecosystem. Organizations concerned about licensing choose OpenTofu; those using Terraform Cloud or HCP Terraform typically stay with Terraform.
How do I test Infrastructure as Code?
IaC testing operates at three levels. Static analysis (Checkov, tfsec, terraform validate) catches misconfigurations without deploying anything. Plan testing verifies that terraform plan produces expected changes. Integration testing (Terratest, kitchen-terraform) deploys real infrastructure to a test account, runs assertions, and destroys it. Most teams implement static analysis first because it provides the highest value with the lowest effort.
Can IaC manage Kubernetes resources?
Yes. Terraform has a Kubernetes provider for managing K8s objects, and Pulumi has native Kubernetes support. However, many teams use Helm charts or Kustomize for application-level K8s resources and reserve IaC for cluster-level infrastructure (the EKS/GKE/AKS cluster itself, node pools, IAM roles, networking). Crossplane takes a different approach by making Kubernetes itself the IaC control plane for all cloud resources.