Infrastructure as Code

The infrastructure as code declares the AWS environment in code (L298) — the code (the resources: the VPC L263, the ECS L295, the RDS L268, L298), the review (the pull requests: the infra changes reviewed like the code's, L298), and the repeatability (the same code → the same environment: the dev, the staging, and the production from the one source, L298) — the L287 cloud, declared (L298).

The one-sentence interview answer: "The infrastructure as code declares the cloud in code (L298). The code (L298): the resources — the VPC (L263), the ECS service (L295), the RDS (L268) — written as the declarative files (L298), not clicked in the console (L298). The review (L298): the infra changes go through the pull requests (L298) — reviewed (L298) like the application code (L298). The repeatability (L298): the same code (L298) produces the same environment (L298) — the dev (L300), the staging (L300), and the production (L302) from the one source (L298) — no drift between them (L298). The reversibility (L298): the code can be reverted (L304) — the environment (L298) rolls back with the code (L298). The drift (L298): the manual console changes (L298) diverge from the code (L298) — the IaC's discipline (L298) detects and reverts them (L298). The AI shape (L287): the L287 cloud (L287) — the VPC (L263), the ECS (L295), the RDS (L268), and the Bedrock's access (L278) — declared in the code (L298), deployed by the pipeline (L296), and reviewed like the application (L298)."

Think of the IaC as the city's zoning code. The zoning code (the IaC files, L298) declares what can be built (the resources, L298): the districts (the VPC, L263), the buildings (the ECS, L295), the reservoirs (the RDS, L268) — written in the code (L298), not improvised (L298). The city council (the pull requests, L298) reviews every change (L298) before it's built (L298) — the zoning change (L298) is public and reviewed (L298). The blueprint (L298) builds the same city everywhere (L298): the model district (the dev, L300), the rehearsal district (the staging, L300), and the real city (the production, L302) from the one zoning code (L298) — no two cities drift (L298). And the inspectors (the drift detection, L298) check the built city against the zoning (L298) — the improvised changes (L298) flagged and reverted (L298). The city works because the zoning is the source, the review is public, and the inspectors check (L298).

   the zoning code (the IaC, L298)
   ┌────────────────────────────────────────────────────────┐
   │ the blueprints (the resources, L298) — the VPC (L263), │
   │ the ECS (L295), the RDS (L268)                         │
   │ the council (the reviews, L298) — the pull requests    │
   │ (L298)                                                 │
   │ the inspectors (the drift check, L298) — the manual    │
   │ changes flagged (L298)                                 │
   └────────────────────────────────────────────────────────┘

The mental model is the zoning code: the blueprints, the council, and the inspectors (L298).

   the change (L298)
        │
        ▼
   ┌────────────────────── THE CODE (L298) ─────────────────────────────┐
   │  the resource declared: the RDS's size (L268, L298)               │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE REVIEW (L298) ───────────────────────────┐
   │  the pull request (L298) — the diff reviewed (L298)               │
   │  the plan (L299) — what will change (L298)                        │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE APPLY (L298) ────────────────────────────┐
   │  the pipeline (L296) applies the code (L298)                      │
   │  the same code → the dev, the staging, the production (L298)      │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE DRIFT CHECK (L298) ──────────────────────┐
   │  the manual changes (L298) → detected (L298) → reverted (L298)    │
   └──────────────────────────────────────────────────────────────────┘

The flow is the change: code → review → apply → drift check (L298).

• The code (L298). The resources declared (L298): the VPC (L263), the ECS (L295), the RDS (L268) — as the declarative files (L298), the single source of truth (L298).
• The review (L298). The pull requests (L298): the infra changes (L298) reviewed (L298) like the application code (L298) — the plan (L299) shown (L298).
• The repeatability (L298). The same code → the same environment (L298): the dev (L300), the staging (L300), and the production (L302) from the one source (L298) — no drift (L298).
• The drift (L298). The manual console changes (L298) diverge from the code (L298) — the IaC's discipline (L298) detects (L298) and reverts them (L298).

• A production AI stack (L287). The L287 cloud (L287) declared in the code (L298): the VPC (L263), the ECS (L295), the RDS (L268), the S3 (L265).
• A multi-environment setup (L300). The dev (L300), the staging (L300), and the production (L302) from the one code (L298) — the same environment (L298), the different values (L300).
• A compliance requirement (L371). The environment (L298) reviewable (L298) — the audit (L322) reads the code (L298), not the console (L298).
• A disaster recovery (L286). The standby region (L286) from the same code (L298) — the DR (L286) reproducible (L298).
• Anything on AWS (L298). The cloud (L287) declared (L298) — the reviewable, repeatable, reversible environment (L298).

The through-line: the blueprint is the cloud's source — the code, the review, and the repeatability (L298).

Say it in four moves:

1. The code. "The resources declared — the VPC, the ECS, the RDS (L298)."
2. The review. "The pull requests — the infra reviewed like the code (L298)."
3. The repeatability. "The same code → the same environment, everywhere (L298)."
4. The drift. "The manual changes detected and reverted (L298)."

• The code is the source of truth (L298). The environment (L298) from the code (L298) — the console (L298) read-only (L298).
• The review is the safety (L298). The pull requests (L298) — the plan (L299) shown (L298), the blast radius (L314) reviewed (L298).
• The repeatability is the environments (L298). The one code (L298) for the dev (L300), the staging (L300), and the production (L302) — the parity (L290), cloud-shaped (L298).
• The drift is the enemy (L298). The manual changes (L298) — detected (L298) and reverted (L298) — the code (L298) wins (L298).
• The pipeline is the hand (L296). The apply (L298) through the pipeline (L296) — the CI/CD (L296) deploys the infra (L298) like the app (L296).

• The console clicks (L298). The manual resources (L298) — the drift (L298) and the mystery (L298).
• The infra un-reviewed (L298). The direct apply (L298) — the review (L298) is the safety (L298).
• The environments diverged (L298). The dev and the production (L300) from the different code (L298) — the one source (L298) is the repeatability (L298).
• The drift un-checked (L298). The manual changes (L298) un-detected (L298) — the next apply (L298) surprises (L298).
• The secrets in the code (L301). The keys in the IaC (L301) — the L301 rule (L301); the variables (L300) and the secrets manager (L275) are the values (L298).

• Declare everything (L298) — the resources (L298) in the code (L298).
• Review the changes (L298) — the pull requests (L298) with the plan (L299).
• One source, many environments (L298) — the dev (L300), the staging (L300), the production (L302).
• Detect the drift (L298) — the checks (L298) in the pipeline (L296).
• Keep the secrets out (L301) — the variables (L300) and the secrets manager (L275).

Q: Walk me through the infrastructure as code.

A: The cloud declared in the code (L298). The code — the resources: the VPC (L263), the ECS (L295), the RDS (L268) (L298). The review — the pull requests (L298). The repeatability — the same code → the same environment (L298). And the drift — the manual changes detected and reverted (L298).

Q: Why IaC and not the console?

A: Three reasons (L298): the review — the infra changes (L298) go through the pull requests (L298) like the code (L298); the repeatability — the same code (L298) builds the dev, the staging, and the production (L300) without the drift (L298); and the reversibility — the code (L298) can be reverted (L304), the environment (L298) rolls back with it (L298).

Q: What's the drift?

A: The divergence (L298): the manual console change (L298) makes the environment (L298) differ from the code (L298). The IaC's discipline (L298): the drift detection (L298) flags it, and the next apply (L298) reverts it (L298) — the code (L298) is the source of truth (L298).

Q: How does the pipeline fit?

A: The pipeline (L296) is the hand (L298): the plan (L299) and the apply (L298) run in the CI/CD (L296) — the infra (L298) deployed like the application (L296), gated by the review (L298) and the plan (L299).

• What's the code (L298)?
• What's the review (L298)?
• What's the repeatability (L298)?
• What's the drift (L298)?
• How does the pipeline fit (L296)?

The senior read: the right column is the discipline — the code, the review, the repeatability (L298).

// The IaC (L298) — the L287 cloud, declared (L298).
// THE RESOURCES (L298) — the code, not the console (L298).
resource "aws_vpc" "ai" {
  cidr_block = "10.0.0.0/16"                // the network (L263)
}

resource "aws_ecs_service" "api" {
  name            = "ai-service"
  task_definition = aws_ecs_task_definition.api.arn   // the runtime (L295)
  desired_count   = 3                                   // the count (L295)
}

resource "aws_db_instance" "postgres" {
  engine         = "postgres"
  instance_class = "db.r6g.large"           // the data (L268)
  multi_az       = true                     // the availability (L261)
}

// THE REVIEW (L298): the pull request (L298) shows the diff and the
// plan (L299) — the change reviewed (L298) before the pipeline (L296)
// applies it (L298). THE DRIFT (L298): the manual change (L298) is
// detected (L298) and reverted (L298) — the code is the truth (L298).

What the reader must SEE — the blueprint, declared:

  aws_vpc + cidr        → the network (L263, L298)
  aws_ecs_service       → the runtime + the count (L295, L298)
  aws_db_instance       → the data + the multi-AZ (L268, L261)
  the PR + the plan      → the review (L298, L299)
  the drift check        → the code is the truth (L298)

  The code, the review, the repeatability (L298).

• The plan is the change's preview (L299). The plan (L299) — what will change (L298) — the review (L298) fast (L298).
• The repeatability is the environments' cost (L298). The one code (L298) — the dev (L300), the staging (L300), the production (L302) — the parity (L298) at the IaC's cost (L298).
• The drift check is the pipeline's time (L298). The check (L298) in the CI (L296) — the seconds (L298) for the truth (L298).
• The state is the apply's speed (L299). The state (L299) — the unchanged resources (L299) skipped (L299) — the applies (L298) fast (L298).

• The IaC = the cloud declared in the code (L298): the code, the review, the repeatability, the drift.
• The code: the resources — the VPC (L263), the ECS (L295), the RDS (L268) (L298).
• The review: the pull requests (L298) with the plan (L299).
• The repeatability: the same code → the same environment (L298).
• The drift: the manual changes detected and reverted (L298).

INFRASTRUCTURE AS CODE = the cloud declared in the code

THE CODE (L298)
  the resources (L298): the VPC (L263), the ECS (L295), the RDS (L268)
  the declarative files (L298) — the single source of truth (L298)

THE REVIEW (L298)
  the pull requests (L298) — the infra reviewed like the code (L298)
  the plan (L299) — what will change (L298)

THE REPEATABILITY (L298)
  the same code → the same environment (L298)
  the dev (L300), the staging (L300), the production (L302)

THE DRIFT (L298)
  the manual console changes (L298) — detected (L298) and reverted (L298)
  the code is the truth (L298)

THE AI SHAPE (L298)
  the L287 cloud (L287) declared (L298)
  the pipeline (L296) applies (L298) · the audit (L322) reads the code (L298)

INTERVIEW, 4 MOVES
  1 code       "the resources declared (L298)"
  2 review     "the pull requests with the plan (L298)"
  3 repeatability "the same code, the same environment (L298)"
  4 drift      "the manual changes reverted (L298)"

You now hold the blueprint: the code, the review, the repeatability, and the drift — with the code as the truth. The cloud has its source — and the zoning is codified (L298).

Next: the plan/apply loop — Terraform Fundamentals (L299).