Defining an IaC strategy
Define an IaC strategy
Infrastructure code is code. The strategy is mostly about applying the disciplines you already apply to application code.
| Discipline | Applied to infrastructure |
|---|---|
| Source control | Templates and modules in git, reviewed by pull request |
| Testing | Lint/build/static checks → validate and what-if the target → deploy and test |
| Promotion | Same template, different parameter files per environment |
| Release | Repeat validation and what-if for production, review/approve, then deploy by pipeline |
The parameterisation rule
Use one shared template or composed template set with parameter files for environment-specific values. Separate environment copies are the anti-pattern: they drift apart, so the configuration validated in test is no longer the configuration promoted to production.
Preview before applying
ARM/Bicep what-if predicts the target-state changes a deployment would make before it makes them. Run validation and what-if against each relevant target, including production, and review the output for creates, modifications, and deletions. It is stronger than a source diff, but it is not an exact guarantee: expansion limits and unresolved expressions can make the result incomplete or noisy.
State and idempotency
Redeploying the same ARM/Bicep desired-state definition and parameters is idempotent. Embedded extensions or deployment scripts are runtime actions, however, and must themselves be authored for safe retries; server-side preflight is best effort and cannot prove every runtime action will succeed.
For environments in a code-promotion chain, prohibit direct control-plane changes and deploy the reviewed source revision through the approved pipeline. Azure authorization, deployment history, and Activity Log still record and govern direct Azure operations; what the pipeline adds is the standardized, versioned approval and provenance path. Sandbox or exploratory environments can use deliberately lighter controls.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/workload-supply-chain
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/overview
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameter-files
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/add-template-to-azure-pipelines
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-preflight
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-history
- https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-script-template