The IaC Operating Model

Scenario: An engineer applies an unreviewed change from a laptop, then leaves before anyone knows which code produced the running infrastructure.

A mature workflow separates authoring, review, planning, approval, and application. Configuration and lock files are committed; state and credentials are not. CI runs formatting and validation, creates a plan against controlled state, and an authorized runner applies it. Small changes, clear ownership, and rollback or roll-forward preparation matter more than clever HCL.

Analogy: Application code review asks what behavior changes; infrastructure review asks what real objects change. Both need an immutable artifact connecting review to deployment.

A worked configuration

terraform fmt -check -recursive
terraform init -input=false
terraform validate
terraform plan -out=change.tfplan
terraform apply change.tfplan

Production teams also control concurrency, retain run logs, restrict who may apply, and design break-glass procedures. Terraform is an execution engine inside that socio-technical system; it cannot compensate for shared admin credentials or plans nobody reads.

Warning: Never treat terraform apply -auto-approve from a developer laptop as a collaboration strategy. Automation should strengthen review and identity, not bypass them.

Goal: Reinforce this lesson in the tf-saved-plan-replacement Terraform lab. Open /labs/terraform and choose slug tf-saved-plan-replacement; the lab runs real Terraform against the offline FakeCloud provider.