Infrastruktur als Code

Infrastructure as Code

Manage infrastructure changes through versioned, reviewable declarations with remote state locking, mandatory plan review before apply, and strict separation between stateful data stores and stateless compute.

Plan-Before-Apply Workflow & State Discipline

1. Remote state with locking:
   • Store Terraform / OpenTofu / Pulumi state in encrypted remote backends with state locking enabled (e.g., S3 + DynamoDB / native S3 lockfile, GCS, or Terraform Cloud) and never commit .tfstate or .tfstate.backup files (which contain plaintext secrets) to version control.
2. Generate and inspect the execution plan on every change:
   • Run plan (terraform plan -out=tfplan, cdk diff, kubectl diff) on pull requests and review the exact resource diff (create, update in-place, destroy / replace) before any apply runs.
   • Treat any unplanned forces replacement (-/+) on a stateful resource (RDS/Cloud SQL database, persistent volume, S3 bucket, DNS zone, KMS key) as a critical blocker.
3. Protect stateful resources against accidental deletion:
   • Set deletion_protection = true, lifecycle { prevent_destroy = true }, or RemovalPolicy.RETAIN on production databases, storage buckets, KMS encryption keys, and stateful volumes.
   • Isolate stateful foundational infrastructure (VPC, databases, KMS, DNS) in a separate state/stack from high-churn application deployment configs so a routine app config update cannot touch database state.

Environment Parity Without Copy-Paste Drift

• Reuse parameterized modules or shared templates across staging and production:
  • Differentiate environments via small, explicit input variable files (envs/staging.tfvars, envs/prod.tfvars)—sizing, replica counts, and domain names—rather than maintaining diverging copy-pasted resource definitions.
• Pin provider and module versions:
  • Commit .terraform.lock.hcl and pin provider/module versions (version = "~> 5.0") so an automated pipeline run never pulls a breaking major provider upgrade unexpectedly.
• Detect and reconcile ClickOps drift:
  • Run scheduled or pre-release drift checks (plan -detailed-exitcode). When out-of-band manual changes are discovered in a live environment, import or codify them into IaC rather than overwriting them blindly.