Infrastructure as Code Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A file is the change you can review

Infrastructure as code here means one resource described in a file you can diff. Terraform, Bicep, and CloudFormation are three languages. Pick one for this account's lab. The generators draft a snippet. They do not log in, and they do not apply.

A plan is the reading step. Apply is a different window. If you cannot explain the plan in a sentence, you do not apply it. A plan that destroys a resource you did not mean to touch is a stop, not a challenge.

State and the credential that can refresh state are secrets in practice. They do not go in git. A backend you can name is part of the decision. A local state file on a laptop is a lab habit you write down, not a team design.

The provisioning companion on the system desk is how a machine gets built once the file is agreed. The provider guide is the product-specific lab. This page is the habit of one file and one plan.

One language, one resource, a plan you can read

Choose the language the team will actually review. Draft one resource, such as a network or a lab machine, with a name that says lab. Read every name. Documentation addresses stay in comments. A real prefix comes from the network guide.

If the draft opens the world, or uses an owner identity, edit it before you even plan. 0.0.0.0/0 is a line you remove. An administrator policy is a line you remove.

Run a plan only against the lab account in the ticket, when that later window starts. Save the plan summary in the ticket: what would be created. If the summary includes a destroy, stop.

The migration guide owns a conversion from one language to another. Do not convert and apply in this hour. One language is the point.

# IaC note. Plan is not apply.
# One language. One lab resource.
# State is not committed.
# Remove 0.0.0.0/0 and administrator identities.
# prompt-for-this is not a cloud credential in the file.

A change you can finish

Apply is a later lab window with a saved plan that creates only what you named.

Rollback is the previous file, or destroying the lab resource the plan created. You do not roll back by editing state by hand.

Pick one language and write why.
Draft one lab resource.
Remove world-open rules and admin identities.
Keep state and credentials out of git.
Read a plan when the lab window starts.
Stop if the plan destroys something.
Leave conversions to the migration guide.

Mistakes that outlive the command

infrastructure as code fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Applying an unread draft.
Two languages for one resource.
State committed to the repository.
A credential in the file or the ticket.
A plan that destroys, followed by an apply anyway.
0.0.0.0/0 left in because the generator emitted it.
Editing state to make a plan look clean.
A production account as the first backend test.
Converting tools in the same hour as the first plan.
No sentence for what the plan creates.

Decisions to write down before the window

One decision for infrastructure as code: One language is named. One resource is in the file. The name says lab. World-open lines are gone. The identity is not an owner. State is not in git. The credential is not in the file. A destroy in the plan is a stop. Apply has its own window. The provider guide owns the product details. Conversion waits. And a second person can say what will be created.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for infrastructure as code. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. infrastructure as code is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

IaC checks before any apply

Confirm this before you call the change done: The file is in the ticket. The language is the one you chose. The resource name is a lab name. No 0.0.0.0/0 remains. No credential is in the file. State location is written and is not the git repo. The plan summary lists creates only, or apply has not been asked. A destroy stopped the work. The account is the lab account. A second person read the plan summary. The previous file is kept. Conversion tools were not run against production. The hostname in the prompt matches the hostname in the ticket for infrastructure as code. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for infrastructure as code happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.

Companion: System: Server Provisioning Guide.