What is Infrastructure as Code (IaC)?

Infrastructure as Code (IaC) Definition

Infrastructure as Code (IaC) is an IT approach that manages, configures and provisions IT infrastructure through code rather than time consuming, error-prone manual processes. IaC automates common, often complex tasks, and performs them in a proven, tested and error-free way.

Infrastructure as Code had its beginnings in IT scripting, where IT pros use PowerShell and other tools to automate common tasks and processes. These tasks tend to be low-level actions that are performed over and over. In contrast, IaC uses deeper, descriptive code that performs more complex provisioning, configuration, deployment and other IT functions.

Principles of Infrastructure as Code

Infrastructure as Code is built on these fundamental principles:

• Automation: Instead of manual configuration, policy creation and implementation, and infrastructure management, the code automates all these functions.
   
• Repeatable Proven Processes: With IaC, IT, DevOps and SecOps can craft processes that are proven to work and apply them automatically and repeatedly anytime the need arises.
   
• Rebuild and Reproduce Systems and Configurations: Proven processes not only apply to new systems and tasks but are used to rebuild or reconfigure existing systems that might have had a problem or need an update.
   

Infrastructure as Code Languages

While there are some languages more popular than others for IaC, the beauty is you can use most any language or scripting solution to implement IaC. Common languages include:

• JavaScript
• C#
• Python

Many find that the best solution are IaC vendor-specific languages, which should be part of an overall IaC solutions framework.

Advantages of Infrastructure as Code in DevOps

DevOps, the approach where development and operations work in sync to achieve enterprise goals, aims to improve software and the way it is built. “The DevOps movement is focused on delivering software faster and more efficiently, without breaking things as often,” argues the What DevOps Means to Me blog.

Automation is a key component of DevOps, and this requires the right development tools which are increasingly IaC solutions. “The tools can start to stitch together an automation fabric for DevOps. Tools for release management, provisioning, configuration management, systems integration, monitoring and control, and orchestration become important pieces in building a DevOps fabric,” the blog maintains.

Configuration management is one area that IT pros dread, and exactly where IaC shines. Managing multiple virtual machines requires proper configuration — loading them with the right software and making sure that software can run. But how can you manage infrastructure when the number of machines you’re responsible for changes daily? The only way to eliminate this disruptive churn is to implement a policy as code-based automation solution that keeps environments consistent.

With IaC, DevSecOps teams create pipelines that can cross both internal and external boundaries, standardizing environments, and processes locally within the data center and up in the cloud. As a result, you get a dynamic environment that’s stable no matter how complicated your configurations are. When your application deployment and infrastructure changes move at the same pace, your entire IT organization functions better.

In fact, environmental configurations are foundational to application and business success. A DevSecOps team that turns configuration into code can leverage the same tools and processes they use on applications to efficiently and successfully prepare environments to run applications.

With IaC, DevOps can:

• Configure systems based on defined business policies
• Test systems and validate states across environments
• Patch and remediate vulnerable systems

As you can see, IaC is a critical technical requirement for running business systems.

Infrastructure as Code Best Practices

Here are a few IaC best practices:

• Make code immutable: Write your code once, test thoroughly, and deploy. Don’t modify the code unless there is a fix or improvement. The new code then becomes your immutable code.
• Apply continuous integration and deployment (CI/CD): This programming best practice is just as vital for IaC as it is for applications.
• Use version control: When code is written, version control ensures the right code is applied.
• Go modular: Modular code is easier to manage, and chunks of code can be easily applied to new tasks.

Infrastructure as Code Framework

IaC is designed to be a systematic approach rather than a one-off. That’s why IaC solutions are best adopted as a framework — a set of interrelated solutions and even processes that broadly and effectively provide Infrastructure as Code implementations and best practices.

Infrastructure as Code Security

User error, IT error and misconfiguration are all sources of security vulnerabilities and causes of breaches and other attacks. At the same time, software built and tested in an undisciplined way is also a hacker’s delight.

Chances are your IT security team has spent countless manhours choosing defense-in-depth components, then building and configuring your security architecture. That is only step one. That very architecture must be updated, maintained, managed, upgraded and regularly configured and reconfigured. Do any of these steps wrong, and that bullet-proof architecture is suddenly full of holes.

Software is the same way. While DevOps speeds software development and deployment, that velocity can introduce errors which make that same software easy pickings.

The answer to all these issues is leveraging IaC to perform error-proof configurations, keeping your security tools themselves safe and your internal applications free from worry.

Infrastructure as Code Scanning

With IaC, everything you need to deploy with purpose-built, identical environments is defined within your configuration files. It’s a potent tool, but using it comes with risks. One of the significant risks include propagating small configuration mistakes across multiple environments. These misconfigurations can range from using insecure default configurations which are quite common with third-party templates to utilizing unencrypted databases. These small issues can leave environments vulnerable to security breaches.

Fortunately, once a misconfiguration is identified you can simply destroy it and replace it with a new secure resource. Running security scans against your IaC code is a powerful way to identify and correct misconfigurations before they snowball into a security disaster. Additionally, teams can scan new commits for configuration changes that no longer match the desired state of the target environment and remediate them.

Automating IaC security scanning is the only cost and time effective way to spot and fix security holes. “Ad hoc security scanning is an effective way to identify and correct vulnerabilities at a specific moment in time. Organizations that are serious about DevSecOps would likely take a more automated approach to this by integrating checks for IaC misconfigurations into the developer workflow,” argues the Best Practices for IaC Security blog.

Infrastructure as Code Provisioning

IaC excels not just at configuration. In fact, offering continuous configuration, it is also a master at provisioning as well. A top IaC solution can describe and automate the whole cluster, soup to nuts, hardware to network to software. This is the promise of Infrastructure as Code: when you write your cluster configuration down as code, suddenly your clusters become testable, repeatable, self-healing, idempotent and, most importantly, easy to understand.

Some of the features of IaC provisioning:

• Describe your application cluster with a set of ‘machine’ resources
• Deploy many copies of your application cluster (test, integration, production …)
• Spread your cluster across different clouds and machines for redundancy and availability
• Orchestrate your deployments, making sure (for example) the database primary comes up before any secondaries
• Speed up your deployments by parallelizing machines with ‘machine_batch’
• Standardize your fleet, and speed up rollouts by creating images without losing the power to patch using ‘machine_image’
• Scale your services effortlessly with ‘load_balancer’ and the ‘machine’ resource.

Infrastructure as Code Testing

Top IaC security testing solutions define policies as code and provide continuous visibility into compliance status across all systems and teams, and ensure audits are continuous, consistent and quick across heterogeneous IT estates.

With IaC testing, organizations can:

• Test the state of everything – from files, packages, users on a server to security groups on cloud resources
• Detect violations by comparing the actual state of systems with the desired state as defined in the policy
• Understand security and compliance status of systems through detailed reports and plan remediation measures
• Scale policies across distributed systems and continuously test systems
• Streamline testing throughout the software delivery process

IaC testing also allows security and compliance policies to be defined as standardized code making it simpler to ensure endpoints within organizations are always secure and conform to regulatory and industry standards.

Test driven development (TDD) results in shorter design cycles that help deliver resilient software consistently. By implementing TDD, you continually evaluate business requirements, develop the right tests and drive good software design.

Infrastructure as Code Compliance

Compliance as Code: IaC helps enterprises achieve compliance in several ways. On the DevOps front, IaC solutions help developers build apps quickly and compliantly. IaC solutions change the way security and DevOps teams test and vouch for software, moving from complex manual processes with spreadsheets and even large paper binders holding documentation and tracking assessments, to error-free automated code. This executable code represents controls that developers can build into their toolchain and workflows.
Meanwhile, compliance scanning can assess formal regulatory compliance, diagnose emerging or recurring security concerns and define compliance standards that suit your enterprise’s unique systems and needs. Compliance reports can then identify compliance issues, security risks and outdated software.

Infrastructure as Code CI/CD

Smart IT and DevOps pros today implement continuous security into their continuous integration/continuous delivery (CI/CD) pipeline .
Many of these CI/CD software changes are tweaks addressing security issues. This approach, to be truly successful, shouldn’t rely on point-in-time security checks, but rather a continuous process of identifying security issues. This requires the type of automation available from IaC.
Today, CI/CD goes beyond application code changes automating not only the continuous integration of the software but also the delivery of infrastructure, supporting systems and requirements for running and maintaining the application. Successful continuous delivery requires not only the successful automated delivery of an application but also:

• Proof that the change was successful and that the application is working as expected
• All environments (Dev, Pre-Prod and Prod) are updated and remain in-sync
• Deployment to any environment (on-prem, cloud, or edge) can be automated
• Supporting tasks (provisioning, testing, auditing, etc.) are automated
• Delivery of supporting tools and platforms is automated
• Security and compliance concerns are addressed

Infrastructure as Code Repository Structure

It is a best practice to have a single IaC code repository for your enterprise or organization. This way, DevOps has one place to go for code, and one source of truth for what is the current build. Having a repository, especially a single repository, makes the DevOps team more efficient and promotes collaboration.

How to Automate Configuration Management with IAC Tools

Here are a few ways to automate configuration management:

• Use policies: Policy as Code brings discipline to your configurations, and also helps ensure compliance.
• Test policies: By testing policies before applying them to configuration tasks, you ensure the code works and can become an immutable solution.
• Use workflows: Workflows are part of your configuration code development, and also how this code can be applied.

IaC Framework

Chef is an open source “infrastructure as code” framework, or set of solutions and approaches that helps you automate your infrastructure and applications. Chef is designed to manage scalable, dynamic infrastructure in any environment.

IAC Case Studies

Today’s forward-thinking enterprises are embracing IaC and reaping the rewards, many using Chef from Progress. “How do you take the continuous delivery, DevOps concepts and scale them across a much larger organization? We proved that what we thought was provable really works and the benefits we suspected we would see we absolutely do see,” said Mike Murphy, Head of IT Operations, Standard Bank, a Chef user.

Discount Tire needed to easily test drive and adopt new technologies. The company took a policy as code approach, building out cookbooks and configurations in Chef to ensure best practice consistency in the infrastructure management and application delivery process. The results included:

• Reduced operational complexity by being able to build and deploy applications on a technology agnostic platform.
• Accelerated rate at which new technologies can be delivered and consumed, resulting in a better end-user experience for Discount Tire customers.

And Cerner, a healthcare technology provider, was using manual processes to maintain the life cycle of systems and deliver healthcare IT solutions at scale. To move forward, the company deployed Chef solutions to ensure security and compliance of underlying platforms and to automate their configuration management.

Through Chef, Cerner fully automated its infrastructure compliance and security, facilitating collaboration across Development, Security and Operations, bridging true DevSecOps to life. “The coded enterprise is the delivery of business value as code. It’s great if we can automate things, but ultimately that has to be tied into a business value, into the results that we desire,” Kyle Harper, Lead Engineering Manager, Cerner says.