infra-standards

Infra standards — the outage-shaped mistakes are all preventable at review time

Infrastructure changes fail differently from code changes: there's no unit test that catches a deleted database, and the blast radius of one line can be the whole environment. These rules exist because every one of them maps to a class of incident — drift nobody can reproduce, a plan nobody read, a secret in an image layer, a pipeline greened by disabling its checks. The theme throughout: infrastructure is code — reviewed, planned, least-privileged, and boring.

How to apply this

When touching any infra surface, hold three questions: what is the blast radius of this change (what can it delete or replace), where do the secrets live (never in the artifact), and would this survive being run twice (idempotency). Run the self-check before shipping.

---

1. Everything is code — no clickops

Any change made by hand in a cloud console/portal is drift: invisible to review, unreproducible, and silently overwritten (or silently load-bearing) the next time the IaC applies. The rules:

• Infrastructure changes go through the IaC files in the repo, PR-reviewed like any code.
• A genuine emergency hand-fix is allowed — and codifying it is part of the same incident, not a follow-up ticket that dies in the backlog. Until it's in code, the fix doesn't exist.
• If IaC and reality disagree, reality is the bug: reconcile toward the code (import the resource or fix the code), never by editing the console to match.

2. Read the plan before you apply — every time

terraform plan / az deployment ... what-if / CloudFormation change sets exist because IaC's most dangerous property is that a one-line diff can mean "destroy and recreate." Changing an immutable attribute (a resource name, an AZ, a SKU) doesn't edit the resource — it replaces it, and for a database that's data loss wearing a green checkmark.

• Never apply a plan you didn't read. In the plan output, destroy and replace lines are the whole review — explain each one or stop.
• In CI, the plan is posted for human review before apply on protected environments; auto-apply is for dev sandboxes only.
• State is sacred (Terraform): remote backend with locking, never hand-edited, never committed to the repo. Use terraform state commands (or import/moved blocks) for surgery — a corrupted state file makes the plan lie to you.