IaC Concepts

A preview describes the world at the moment it was computed, so anything that changes afterwards causes skew: another apply, a console edit, an autoscaler, or values that only resolve during apply. Teams narrow it by serializing applies behind a lock, applying the reviewed artifact, and keeping approval-to-apply short.

Each run reads the record, changes real infrastructure, then writes the record back. Interleaved, the later write overwrites the earlier one, so resources the first run created vanish from the record and become unmanaged orphans. A mutual-exclusion lock serialises the write-bearing operation.

Only a real apply exposes what the provider decides at request time: quota and limit refusals, missing permissions, argument combinations the schema allows but the API rejects, name collisions, region or capacity unavailability, slow eventual consistency, and dependency-ordered failures including destroys that hang or leave orphans.

Decide per resource by comparing the cost of being wrong with the cost of being corrected automatically. Reversible, numerous, cheap-to-recreate resources belong on the fast loop; destructive or data-bearing ones stay human-gated. Above all, give every field exactly one owning loop.

Gate on the content of the diff rather than on every change: destructive, stateful, security-relevant and production changes need a human, additive and reversible ones do not. An approval is meaningful only when the approver can read the diff, is accountable for the resource, and can realistically decline.

Make exemptions explicit, narrowly scoped to one rule and one resource, time-bounded with an expiry that re-fails, attributed to a named requester and an independent approver, and visible in aggregate. Blanket skips and permanent unowned exceptions are what hollow out a guardrail.

A real apply costs minutes to hours, real money, and finite account quota, and it fails intermittently for provider reasons. So pull requests get fast, deterministic checks, a scheduled run pays for the expensive real deployment, and pre-release runs the full path once against realistic scale.

No. The authoring language and the deployment model are separate axes. A program with loops and conditionals can still produce a complete description of desired state, which an engine then compares against reality before changing anything.

Edge-triggered automation acts on change events; level-triggered automation repeatedly inspects the current state and closes whatever gap it finds. Reconciliation is level-triggered because a missed, duplicated or out-of-order event leaves an edge-triggered system permanently wrong, while a level-triggered one self-heals on the next pass.

A stateless tool re-derives reality from the target on every run: each step reads the current condition and acts only if it differs. It has nothing to lose, lock or leak, but it cannot notice that something you deleted from the code should be removed.

Saving the reviewed diff and executing exactly that artifact guarantees the change a human approved is the change that runs. Recomputing at apply time silently applies a diff nobody saw. The costs are artifact plumbing between jobs, a sensitive file to protect, staleness failures, and a hard version pin.

A policy pipeline evidences that every change passing through it was evaluated against named, versioned rules, with verdicts, overrides and approvers recorded per commit. It proves nothing about changes made outside that path, or about rules you never wrote.

A contract test pins the module's published interface — its input names, types, defaults, required-ness and its outputs — and fails when a change breaks a consumer even though the module still works internally. Internal tests only check behaviour, not compatibility.

Usually one repository, because promotion across repositories degrades into copying and the environments drift. Separate repositories buy a hard permission boundary, but the same boundary is cheaper to get from path-based ownership rules plus per-environment credentials — and the credentials, not the repository, are what actually gate production.

Scan on a cadence matched to blast radius using read-only credentials, route each finding to the team that owns the code rather than a central channel, suppress known-owned attributes deliberately, and treat drift rate as a process metric rather than auto-reverting.

Mandate replacement where it is cheap and state-free, and where the fleet is large enough that divergence is unmanageable. Where state, rebuild cost or a vendor blocks replacement, require reproducible builds and detectable divergence instead, as an explicit, audited exception.