Infrastructure as Code (IaC)
debt(d7/e9/b7/t5)
Closest to 'only careful code review or runtime testing' (d7). The detection_hints note automated=no and that violations appear as manual cloud console changes or undocumented server configuration. Tools like terraform, pulumi, ansible, and cloudformation can detect drift (e.g., terraform plan), but only when run deliberately — no passive safety net catches the absence of IaC or manual drift automatically in CI. It surfaces during apply failures or post-incident reviews, not instantly.
Closest to 'architectural rework' (e9). The quick_fix says 'define all infrastructure in Terraform or Pulumi — never make manual changes' but this is a broad directive, not a one-line patch. Adopting IaC retroactively means inventorying all existing infrastructure, writing declarative definitions, importing or recreating state, establishing remote state, integrating secrets management, and adding staging pipelines — a full architectural practice change that reshapes how the entire operations workflow is structured.
Closest to 'strong gravitational pull' (b7). IaC applies to web and cli contexts broadly and the tags span devops, automation, infrastructure, and cloud. Once IaC is in place (or absent), every infrastructure change must conform to or work around that choice. The common_mistakes highlight that manual changes after IaC cause dangerous drift — meaning the IaC choice shapes every future infrastructure operation. It doesn't quite define the entire system shape (b9) but exerts strong gravitational pull on all ops and deployment workflows.
Closest to 'notable trap — a documented gotcha most devs eventually learn' (t5). The misconception field states that developers commonly believe IaC just means provisioning scripts, missing the versioning, review, reproducibility, and testing discipline. The common_mistakes reinforce this: making manual changes after IaC is in place (drift), not using remote state, and storing secrets in IaC files are all documented gotchas. These are real but learnable traps rather than catastrophically counter-intuitive behaviors.
Also Known As
TL;DR
Explanation
IaC applies software engineering practices — version control, code review, CI/CD, testing — to infrastructure management. Tools include Terraform (cloud-agnostic declarative provisioning), Ansible (agentless configuration management), CloudFormation (AWS-specific), and Pulumi (infrastructure in real programming languages). Benefits: reproducible environments (dev/staging/production parity), disaster recovery from code in minutes, peer review of infrastructure changes, and audit trail in git. For PHP deployments, Ansible playbooks commonly manage PHP-FPM configuration, nginx vhosts, TLS certificates, and Composer install workflows as part of the deployment pipeline.
Common Misconception
Why It Matters
Common Mistakes
- Making manual changes to infrastructure after IaC is in place — drift between code and reality causes the next apply to fail dangerously.
- Not using remote state — local Terraform state is lost when the machine dies and blocks collaboration.
- Storing secrets in IaC files — use a secrets manager and reference secrets by name, never value.
- Applying changes to production without testing in a staging environment first.
Code Examples
# Manual server setup — not reproducible:
ssh new-server
apt-get install nginx php8.3-fpm
nano /etc/nginx/sites-available/myapp # Hand-edited
# No record of what was installed or configured
# Cannot reproduce exactly — 'works on this server'
# IaC with Terraform:
resource "aws_instance" "web" {
ami = "ami-12345"
instance_type = "t3.medium"
user_data = file("setup.sh") # Reproducible, version-controlled
}# Terraform — declarative infrastructure
resource "aws_instance" "web" {
ami = "ami-0c55b159cbfafe1f0"
instance_type = "t3.micro"
tags = { Name = "php-app", Env = "production" }
}
resource "aws_db_instance" "main" {
engine = "mysql"
engine_version = "8.0"
instance_class = "db.t3.small"
# ... version-controlled, code-reviewed, repeatable
}
# Apply
$ terraform plan # dry run — shows changes
$ terraform apply # provision/update