Infrastructure as Code

Manually creating infrastructure is a thing of the past. If you are not using infrastructure as code as an enterprise, you are already behind the competition. This post aims to give a high level overview of what infrastructure as code is and how it can help you.

Infrastructure as Code (IaC) is the automated provisioning and management of infrastructure through code instead of through a manual process. IaC makes many aspects of the infrastructure management and development process automated, providing many benefits to the enterprise and DevOps teams.

Through this post, I hope to present to you why IaC is important, outline best practices, and present known challenges. At the end, I am going to outline several IaC tools available on the market today.

Why Use Infrastructure as Code?

As discussed, infrastructure as code (IaC) simplifies the infrastructure building process. IaC automates all components necessary to build a usable infrastructure for your organization making it easier to perform tasks such as creating new environments or building servers. IaC also aligns the development and operations teams through a DevOps approach which leads to a significant decrease in observable errors.

As cloud computing adoption rates increase, so does the need for an automated infrastructure increases. This is to ensure that businesses are maintaining compliance requirements throughout their infrastructure in different environments. However, infrastructure as code works best in cloud-based environments with many IaC tools offering the ability to integrate with on-premise environments too.

More and more businesses are taking advantage of the remote workforce and small to medium enterprises (SME) are making the move to cloud computing for its many benefits. These businesses are able to leverage IaC for these environments to automate the creation of different environments faster than what has ever been conceivable. Further, most IaC tools are idempotent, meaning that resources will not get created again and again even if the initial operation fails but the resource was successfully created.

Benefits of IaC

Understanding the benefits of Infrastructure as Code (IaC) is paramount when discussing why you should use IaC for your personal or business infrastructure.

The most obvious benefit of using IaC is that the management of infrastructure changes become easier, as the infrastructure will always have a version in version control or software configuration management.

As discussed above, IaC allows the business to remove the human element when building environments. This happens as an accelerated rate and can used with a delivery pipeline such as Jenkins or TeamCity. Also, the changes can be triggered in response to an event allowing the infrastructure change to be automated and without human intervention.

Multiple environments become a possibility when implementing Infrastructure as Code. For example, path to prod may require a development environment, a QA environment, staging, and then production. All of these environments can be spun up from the same code-base ensuring that services are deployed and managed in a consistent environment. Organizations and independent workers who manage multiple organizations or environments would be able to ensure consistencies between environments with IaC.

Many organizations have what are known as “pet” servers. “Pet” servers are servers that were manually built, managed, and even given pet names. The care and maintenance of these servers was relatable to how people treat their own pets. With IaC, we can change “pet” servers into “cattle” where we do not have to worry about the maintenance of individual servers. IaC tools can be ran to rebuild servers if something goes awry knowing that the server will be put into a working state because of the rebuild.

Challenges of IaC

As with all tools and practices, there are a number of challenges that should be considered before implementation or adoption. Infrastructure as Code (IaC) is no different and comes with several challenges that new practitioners may face.

The biggest challenge that many organizations face is a dependency on coding language. Every IaC tool is different and uses a different language. The most popular IaC tool is Terraform, and it uses a proprietary language known as HashiCorp Configuration Languages (HCL) while others use JSON, Python, YAML, Ruby, etc. There is a need for these skill sets in the professional workforce as cloud adoption rates continue to rise.

Security is another challenge that businesses are faced with when implementing IaC tools and methods. For instance, the state file for some of the IaC tools are not encrypted and if there are secrets used for the infrastructure, there is a high chance that these secrets show up as plaintext in these documents. The assessment process for security may also be lacking because many security processes were put in place to handle legacy-type systems and as such, these security tools may need to be manually checked for some time to ensure accurate provisioning and operation.

Finally, there is the issue of duplication of errors in environments provisioned with Infrastructure as Code. If one configuration issue is present in one environment, there is a higher chance that these errors or configuration issues are present in the other environments. There are many ways to combat these issues which will be discussed in the next section, IaC Best Practices.

IaC Best Practices

It is important to understand how to properly use the IaC tools. The most important action to ensure best practice is to implement IaC best practices right from the start. This ensures that all of the infrastructure and code that is built or developed with the tool, is safe and secure.

This is not an exhaustive list of best practices.

IaC best practice would ensure that the business is using IaC tools for what they were built for instead of attempting to do everything with one tool. You might be thinking, “hang on, that is counter-intuitive.” However, each one of these tools was built for a specific reason, whether it is for building out infrastructure or configuring systems and services. However, it is important to understand the needs to the business and internal processes to determine which tool works best where. Otherwise, you may end up on version 200 of a Chef cookbook for user creation when the change that is causing the increment could be handled with Terraform.

Ensuring proper configuration of the environment and scanning files prior to deployment is not necessarily a requirement but could be considered an IaC best practice. There are many tools out there that will offer scanning for configuration issues in your IaC files prior to deploying to production.

Finally, maintain the state file. Oftentimes, organizations find themselves doing manual modifications to infrastructure and this causes drift in the state files of the infrastructure. These “little” changes can cause big issues, so it is important to ensure that any changes required are well-documented and performed with the chosen IaC tool.

IaC Tools

There are many tools on the market that you can use for Infrastructure as Code. I have provided a few below but this is not an exhaustive list.

• Terraform: A free and open-source tool that was created by HashiCorp. It is has widely become the industry standard and one of the most popular Infrastructure as Code tools on the market.

• Chef: A tool that is used to describe the system’s steps to arrive at the desired destination.

• **SaltStack: A python-based IaC tool that uses both remote connections and agent-based operations to build infrastructure and configure systems and services.