Infra Automation Highlights Summary

Every highlight bullet from the 9 pages in this section, gathered on one page and grouped by the page it came from.

The Declarative Infrastructure Mental Model

• Declarative tools describe the end state, not the steps to reach it
• Idempotency means running the same code twice changes nothing the second time
• A reconciliation loop diffs desired state against real state, then acts on the delta
• State files are the tool's memory of what it believes already exists
• Drift is any gap between declared state and what is actually deployed
• Plan-before-apply exists because the diff, not the code, is the real review artifact

Infrastructure Automation Basics

• Infrastructure as code is versioned, reviewed, and replayable
• Idempotent operations converge state without manual cleanup
• Separate config data from automation logic
• Plan before apply - never surprise production

Ansible

• Idempotent modules report state changes to enable convergence
• Deploy agentless over SSH without installing target daemons
• Encrypt secrets in version control with Vault, decrypt at runtime
• Handlers run at end of play only if a task notifies them
• Bundle tasks, templates, and defaults into reusable roles
• Call Ansible from Python via ansible_runner for orchestration

Pulumi (Python IaC)

• Write infrastructure as real Python with loops, functions, and tests
• Stable logical names in loops prevent unnecessary resource replacements
• Encrypt sensitive config with the --secret flag to hide from stack files
• Lock provider versions in pyproject.toml to prevent plan churn
• Run pulumi preview to see diffs, then pulumi up to apply changes
• Use StackReference to consume outputs from other stacks as inputs

Terraform with Python

• CDK for Terraform and Python CLI wrappers let teams write Terraform in Python
• CDKTF synth emits inspectable JSON output for platform team review before apply
• Python wrappers insert policy hooks between Terraform plan and apply steps
• CDKTF maintains standard Terraform backends, state, and S3 plus DynamoDB locking
• Use Python classes for reusable constructs instead of repeated HCL modules
• Exit codes from Python orchestrators integrate directly with CI pipeline gates

Configuration Management

• Use pydantic BaseSettings and Jinja2 to separate config from templates across environments
• Store secrets in SSM/Vault/Secrets Manager, never commit API keys or passwords to git
• Merge base and environment YAML files to keep configuration structure DRY and maintainable
• Render config at deploy time with injected secrets, validate before apply with Pydantic
• Layer architecture uses data YAML, secret stores, Jinja2 templates, then Ansible/Kubernetes
• Use SecretStr to keep sensitive values out of logs and error messages during runtime

Provisioning Cloud Resources

• Idempotent ensure catches QueueDoesNotExist and creates on fallback
• Use IaC for VPCs and IAM baselines; boto3 scripts for pipeline glue
• Set botocore Config retries to 10 with standard mode for resilience
• Check resource existence before create to prevent BucketAlreadyExists errors
• Apply tags on every run to converge metadata and enable cost tracking
• Verify resources with describe APIs and integration tests

Testing Infrastructure Code

• Testing infra code prevents expensive production failures
• Run ruff, pytest, and terraform plan in CI before any cloud apply
• Use terraform -detailed-exitcode to distinguish 0=no changes, 2=pending, 1=error
• Test pyramid spans unit policy checks, synth graphs, plan validation, sandbox applies
• Assert plan JSON shows zero unexpected delete actions
• Skipping infra tests risks one typo deleting a database

Infrastructure Automation Best Practices

• Every apply maps to a reviewed git commit
• Plan before apply - no surprise deletes
• Secrets never live in plain config repos
• Policy tests gate merges before cloud calls