Infrastructure as Code & Config Management

A data block reads information about infrastructure Terraform does not manage and exposes it to the configuration. Terraform never creates, updates or destroys what a data block reads; a resource block declares an object Terraform owns for its whole lifecycle.

A dynamic block produces repeated nested blocks from a collection: for_each supplies one element per block and the content block holds the block body. For a security group you iterate a list of rule objects to emit one ingress block each.

Since Terraform 0.12, expressions are first-class, so you write var.name directly. The ${ } syntax is only for embedding an expression inside a larger string, such as "app-${var.env}". Quoting a whole expression adds nothing and Terraform warns that it is deprecated.

Declare a second aws provider block with an alias argument and its own region, then set the meta-argument provider = aws.<alias> on each resource that belongs in that region. Resources with no provider argument use the unaliased default block.

Keys written into HCL get committed, cloned and copied, and cannot be rotated per run. Omit access_key and secret_key; the AWS provider then resolves credentials itself from environment variables, the shared AWS config files, or an attached instance or CI role.

Pulumi runs your program before the cloud has created anything, so resource attributes are Output<T> placeholders for values known only after deployment. Derive new values with apply(), pulumi.all() or pulumi.interpolate — never by concatenating an Output as a string.

A Pulumi stack is one independently configurable instance of a program, with its own config file, its own state and its own outputs. Running the same program against dev, staging and prod stacks gives three isolated deployments and no duplicated code.

A ComponentResource is a logical grouping of other resources exposed as one reusable class — Pulumi's module equivalent. Its constructor must call super with a type token and name, create every child with the parent option set to itself, and finish with registerOutputs.

Pulumi encrypts values you mark as secret before they are written anywhere. pulumi config set --secret stores ciphertext in Pulumi.<stack>.yaml, secretness propagates into the state checkpoint, and the secrets provider — a passphrase, a cloud KMS key, or the Pulumi Cloud per-stack key — holds the encryption key.

A general-purpose language buys real control flow, static types, IDE completion and unit tests over infrastructure logic. It costs reviewability: a pull request now shows the program that produces resources rather than the resources themselves.

Constructs are the composable building blocks of the tree; a Stack is the deployment unit that synthesizes into exactly one CloudFormation stack; the App is the root object holding every stack. Only stacks become real AWS deployments.

AWS CDK constructs come in three levels: L1 Cfn classes mirror CloudFormation resources one-to-one with no defaults, L2 constructs add sensible defaults and helper methods such as the grant helpers, and L3 patterns assemble many resources into one opinionated component.

cdk synth runs your CDK program and writes a cloud assembly into cdk.out: one CloudFormation template per stack, asset manifests, and staged asset files. It deploys nothing and changes no AWS resources.

An environment-agnostic stack deploys wherever the CDK CLI's credentials point. Its account and region become unresolved tokens backed by CloudFormation pseudo-parameters, so synth-time lookups such as Vpc.fromLookup fail and the stack assumes only two availability zones.

Calling grantRead adds a policy statement to the Lambda function's execution role in the synthesized template, scoped to that bucket's ARN and its objects, and it also grants decrypt on the bucket's encryption key when the CDK app knows about one.

Drift detection compares a stack's live resource configuration against the values its template and parameters expect, then reports the differences. It is read-only and on demand: CloudFormation never reverts drift for you and never watches resources continuously.

Ref returns one default value chosen by the resource type — usually its name or physical ID — while Fn::GetAtt returns a specific named attribute of that resource. Only the resource type's documentation says which value each one produces.

A change set is a stored, named preview of what an AWS CloudFormation stack update would do, computed without applying anything. Its Replacement field is the thing to read: True means the resource is deleted and recreated with a new physical ID.

UPDATE_ROLLBACK_FAILED means CloudFormation could not restore the stack's previous state, so it refuses further updates. Fix whatever blocked the rollback, then call ContinueUpdateRollback — skipping unrecoverable resources only as a last resort, since that leaves records inaccurate.

ROLLBACK_COMPLETE means the creation failed and CloudFormation deleted everything it had made, leaving an empty stack record that only accepts deletion. Delete the stack, fix what the failure event reported, and create it again.

An Ansible inventory is the list of managed hosts and the groups holding them, written as static INI or YAML files or produced by a dynamic plugin. Every host is automatically in the group all; a host in no other group is also in ungrouped.

Ansible's command module executes a program directly with no shell, so pipes, redirects, globs and environment-variable expansion do not work. The shell module runs the command line through a shell on the target, so they do. Prefer command unless you need shell features.

An Ansible role is a fixed directory tree - tasks/, handlers/, defaults/, vars/, files/, templates/, meta/. Ansible auto-loads main.yml from each of those directories, and resolves copy and template sources against files/ and templates/.

The default filter supplies a value only when the variable is undefined. Passing true as a second argument also replaces empty or otherwise falsy values. Passing the special omit value removes the parameter from the task entirely, so the module applies its own default.

Ansible Vault symmetrically encrypts variable files or single values with a password so they can be committed to git. Ansible decrypts them in memory at run time. It protects secrets at rest only — anyone holding the password reads everything.

Chef adds the resource to the run's resource collection with a desired state. During converge, the matching provider inspects the node, compares current state to desired, and acts only when they differ — so a second run changes nothing.

Compile evaluates every recipe as Ruby and builds an ordered resource collection; converge then walks that collection and lets each provider act. Bare Ruby in a recipe runs during compile — before any resource has taken effect — so it sees the node's pre-run state.

Berkshelf resolves the metadata.rb constraints into a Berksfile.lock and uploads the cookbooks, while the Chef Infra Server pins versions per environment and expands the run list at run time. Policyfiles replace both with one artefact that locks the run list and every cookbook version together.

Judge the cookbooks, not the tool's reputation: whether they are declarative and idempotent, whether anyone left can debug a compile-versus-converge bug, and whether the Chef Infra Server plus agent estate is worth operating. Working, quiet cookbooks are a poor migration candidate.

On each run interval the Puppet agent collects Facter facts and sends them to the Puppet Server, which compiles a node-specific catalog from the manifests and Hiera data for that node. The agent applies that catalog locally, then posts a report back.

Puppet applies a dependency graph, not the file top to bottom. Ordering comes from require, before, notify and subscribe, the chaining arrows, and autorequire; notify or subscribe also sends a refresh event, which is what restarts a service after its config changes.

Pull buys continuous, unattended enforcement: every node re-applies its catalog on an interval, so manual changes get corrected and rebuilt nodes converge without anyone driving them. The cost is an agent and certificate per node, propagation latency, and no ordered cross-host orchestration.

Run the agent in no-op mode — puppet agent -t --noop, or noop = true in puppet.conf. Puppet still compiles the catalog and inspects every managed resource, but reports out-of-sync ones instead of correcting them. It says nothing about resources the catalog does not declare.

Salt minions hold a persistent ZeroMQ connection out to the master. A command is published once onto that bus, every minion that matches the target expression evaluates it locally and runs it, then returns its own result, so fan-out time barely grows with host count.

Grains are facts the minion discovers about itself (OS, CPU, IP) and reports upward. Pillars are data the master compiles and sends down to specific minions. Secrets belong in pillar, because pillar is master-controlled and delivered only to the minions it targets.

The agent buys constant-time fan-out and event-driven reaction: connections are established once, so a command is one publish rather than 5,000 SSH handshakes, and minions can push events the master reacts to. It costs an agent lifecycle, key management and a master that is root-everywhere.

A beacon runs on the minion, watches something local — a service, a file, disk usage — and fires a tagged event onto Salt's event bus. The master's reactor matches event tags to reactor SLS files and issues the response, which is what makes Salt the event-driven configuration tool.

A component packages a pattern once behind a small input interface, so the tenth service is a few lines instead of a hundred. It also shrinks what each change touches: smaller reviews, faster runs, and a mistake that stops at one component instead of the whole estate.

Declarative code describes the end state you want and lets the tool work out the steps to reach it; imperative code lists the steps themselves. IaC tools are declarative so the same file can be applied repeatedly and still describe one known result.

Convergence means each run moves the system toward the declared state and stops when it matches, so a second run with no changes does nothing. A half-finished run is safe to repeat: the tool redoes only the work still outstanding.

Drift is divergence between what your infrastructure code declares and what actually exists at the provider. Common causes: console or emergency edits, autoscalers and other controllers changing fields, provider-applied defaults, and a second tool managing the same resource.

Mutable infrastructure is changed in place — you patch and reconfigure the servers you already run. Immutable infrastructure never edits a running server: you build a new image, launch replacements from it, and destroy the old instances.