Cybersecurity glossary
What is Infrastructure as Code (IaC)?
Learn what Infrastructure as Code is, how declarative cloud configuration improves repeatability, and why IaC changes need review, testing, and security controls.
Definition
Infrastructure as Code (IaC) is the practice of defining, provisioning, and changing infrastructure through version-controlled machine-readable configuration instead of manual console or ticket-driven changes.
Why Infrastructure as Code (IaC) matters
Manual infrastructure changes are hard to review, hard to reproduce, and easy to forget. A console click that opens a storage bucket or broadens a security group may never appear in a code review or release note.
IaC moves infrastructure decisions into versioned files and repeatable pipelines. That makes cloud changes easier to test, approve, audit, roll back, and standardize across teams.
What IaC brings under version control
Compute and networks
Instances, clusters, load balancers, subnets, routes, firewalls, and service meshes.
Identity and access
Roles, policies, service accounts, trust relationships, and permission boundaries.
Data services
Databases, buckets, queues, encryption options, backup settings, and retention rules.
Platform defaults
Reusable modules and templates that encode approved architecture patterns.
How an IaC change flows
Author the desired state
Engineers edit modules, templates, manifests, or policy files in a repository.
Review the change
Peers inspect what infrastructure will change, not only whether syntax is valid.
Plan the diff
The IaC tool compares current state with desired state and shows creates, updates, and deletes.
Run checks
Linting, policy, cost, security, and drift checks catch risky changes before apply.
Apply with controls
A pipeline applies approved changes using scoped credentials and recorded logs.
Monitor drift
Teams compare real infrastructure with code to catch manual edits and unmanaged resources.
IaC models compared
| Model | Example | Security focus |
|---|---|---|
| Declarative desired state | Terraform, OpenTofu, CloudFormation, Kubernetes manifests | Review planned changes and enforce policy on final resources |
| Imperative automation | Scripts and some configuration management playbooks | Control execution paths, credentials, and idempotence |
| Reusable modules | Approved network, database, or service templates | Bake safe defaults into shared building blocks |
| GitOps | Cluster or cloud state reconciled from Git | Protect repository, approvals, and controller identity |
Infrastructure as Code checklist
- Store IaC in version control with mandatory review for production changes.
- Use reusable modules for approved network, identity, logging, and encryption patterns.
- Run plan previews in pull requests so reviewers see resource-level impact.
- Scan IaC for misconfigurations before apply.
- Separate plan and apply permissions; avoid broad personal cloud credentials.
- Protect state files because they can contain sensitive identifiers or secrets.
- Detect drift and reconcile manual changes back into code.
- Tag owners, environments, data sensitivity, and cost centers in infrastructure definitions.
The practical takeaway
Infrastructure as Code (IaC) makes infrastructure reviewable software. The advantage is not just speed; it is the ability to apply engineering discipline to networks, identities, data stores, and platforms.
The same repeatability that makes IaC powerful can also replicate mistakes quickly. Keep the pipeline guarded with reviews, policy checks, scoped credentials, and drift detection.
Related security terms
IaC Security Scanning
Automated checks that find risky cloud and infrastructure definitions before deployment.
CI/CD Pipeline
The delivery system that plans, tests, approves, and applies infrastructure changes.
Build Pipeline
Automation that turns versioned inputs into repeatable deployment outputs.
Secure by Design
Designing infrastructure defaults so safe patterns are the easiest path.
Attack Surface
Infrastructure changes can expand exposed services, identities, networks, and data stores.
Frequently asked questions
What is IaC in simple terms?
IaC means you describe servers, networks, permissions, and cloud services in files, then tools apply those files to create or change infrastructure.
Is IaC the same as automation scripts?
Not exactly. Scripts execute steps imperatively. IaC often declares desired state, lets the tool calculate changes, and stores that desired state in version control.
How is IaC different from IaC security scanning?
IaC is the infrastructure delivery practice. IaC security scanning is a control that checks those definitions for risky patterns such as public storage or overbroad IAM.
Why is version control important for IaC?
It gives infrastructure history, peer review, rollback context, and a single place to enforce policy before changes reach cloud accounts.
Does IaC eliminate configuration drift?
It reduces drift but does not eliminate it. Manual console edits, emergency fixes, and unmanaged resources still need drift detection and reconciliation.
What are common IaC tools?
Common tools include Terraform, OpenTofu, CloudFormation, Azure Bicep, Pulumi, Ansible, Kubernetes manifests, and Helm charts.
What security risks can IaC introduce?
IaC can rapidly replicate public exposure, weak encryption, excessive IAM, insecure network rules, and secrets in code if reviews and policy checks are weak.
References
Explore authoritative guidance and frameworks related to infrastructure as code (iac).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.