Terraform, Ansible, declarative IaC, drift detection, CI/CD: master Infrastructure as Code to industrialize your infrastructure. A complete Smile guide.
A manually configured infrastructure is one whose state no one truly knows. A server hastily modified without documentation. A difference between staging and production that no one can explain. A deployment that works in one environment and fails in another for obscure reasons.
Infrastructure as code solves these problems at their root. By coding the infrastructure rather than clicking on it, it becomes versioned, reproducible, testable, and deployable with a single command.
This guide explains the fundamentals, the two reference tools (Terraform and Ansible) and best practices for implementing IaC in your organization.
What is Infrastructure as Code?
Infrastructure as Code (IaC) is the practice of describing, provisioning, and managing IT infrastructure (servers, networks, databases, security rules) via versioned code in a Git repository, rather than via manual configurations or graphical interfaces.
The infrastructure thus becomes a software asset like any other: it is reviewed, tested, versioned and deployed with the same practices as application code.
IaC and DevOps: an inseparable pair
Infrastructure as Code (IaC) is one of the fundamental practices of DevOps . It bridges the historical gap between developers who deliver code and the Ops teams who manage the infrastructure on which that code runs. When the infrastructure is coded, developers can contribute to its definition, Ops teams can review it like code, and everyone shares the same view of the environment's state.
The fundamental benefits
Three benefits justify the adoption of IaC in any organization that operates a production infrastructure.
Reproducibility is paramount. An environment described in IaC can be recreated identically in minutes, on any cloud or datacenter. No more "it worked on my environment."
Version control is the second feature. Every infrastructure change is tracked in Git with an author, a date, and a commit message. The complete history is accessible, and rollbacks are possible.
Collaboration is the third key element . Infrastructure changes are submitted via pull requests, peer-reviewed, and validated before being implemented. No more undocumented changes in production.
Declarative IaC vs. Imperative IaC
There are two approaches to IaC.
The declarative approach involves describing the desired end state of the infrastructure. The tool then calculates the actions necessary to reach that state. Terraform uses this approach. Advantages: inherent idempotence and readability.
The imperative approach involves describing the actions to be performed to reach the desired state. Ansible can operate in imperative mode, although it prioritizes idempotence. Advantage: flexibility and fine-grained control over the order of execution.
Terraform: the benchmark multi-cloud IaC
Terraform is the declarative infrastructure provisioning tool developed by HashiCorp and has been open source since its inception. It has become the de facto standard for provisioning cloud resources on AWS, Azure, GCP, and dozens of other providers.
Key concepts
- Provider : the connector that allows Terraform to interact with a cloud API or a third-party service (AWS, Azure, GCP, Kubernetes, GitHub)
- Resource : the infrastructure resource to create or manage (an EC2 instance, a security group, an S3 bucket)
- State : the file that contains the current state of the infrastructure managed by Terraform. It is Terraform's memory, allowing it to calculate the differences between the desired state and the actual state.
- Module : a set of reusable resources, packaged to be shared between projects or teams
The Terraform workflow
A Terraform deployment follows four steps.
- `terraform init` : initializes the project, downloads the necessary providers and modules
- Terraform plan : calculates and displays the changes that will be applied without actually implementing them. This is the review step before any modification.
- `terraform apply` : applies the planned changes and updates the state
- terraform destroy : deletes all resources managed by the project
Terraform Cloud and alternatives
Terraform Cloud (HashiCorp) is the SaaS platform that manages state remotely, orchestrates plans and applies, and integrates validation workflows. OpenTofu is the open-source fork of Terraform maintained by the Linux Foundation, created after HashiCorp's license change in 2023. Pulumi is an alternative that allows the infrastructure to be written in traditional programming languages (Python, TypeScript, Go) rather than HCL.
Ansible: Configuration Automation
Ansible is an open-source automation tool developed by Red Hat. Its positioning is complementary to Terraform: where Terraform provisions the infrastructure, Ansible configures the systems and deploys the applications on that infrastructure.
Key concepts
- Inventory : the list of target machines (servers, VMs, containers) on which Ansible will operate, defined in YAML or INI file
- Playbook : the YAML file that describes the tasks to be executed on the inventory machines, in the defined order.
- Role : a set of tasks, variables and files organized in a reusable and shareable way
- Module : the basic building block that performs a specific action (install a package, copy a file, restart a service)
Idempotence: the fundamental principle
Idempotence means that running an Ansible playbook multiple times on the same machine always produces the same result. If the package is already installed, Ansible does not reinstall it. If the file is already in place, Ansible does not overwrite it.
This principle is what makes Ansible reliable in production: you can run a playbook without fear of altering a system that is already correctly configured.
Ansible vs. Puppet vs. Chef
ToolApproachAgent requiredLanguageLearning curveAnsibleAgentless, SSHNoYAMLowPuppetAgentbasedYesDSL PuppetHighChefAgentbasedYesRuby/DSLHighSaltStackHybridOptionalYAML/PythonMedium
[Table in the Google Sheet to copy here]
Ansible is becoming the standard in most new projects thanks to its agentless architecture (no daemon to install on target machines) and its ease of use.
Terraform vs Ansible: when to use one or the other?
Criteria | Terraform | Ansible |
Main role | Infrastructure provisioning | Configuration and deployment |
Approach | Declarative | Declarative and imperative |
State management | Yes (state file) | No |
Idempotence | Native | Depends on the modules |
Cloud management | Excellent | Limited |
OS configuration | Limited | Excellent |
Learning curve | Average | Weak |
The winning combination
Terraform and Ansible are not competitors. They cover two distinct layers.
Terraform creates the infrastructure: VMs, networks, security groups, managed databases. Ansible configures what Terraform has created: installs packages, deploys applications, configures services, manages certificates.
Together, they cover the entire infrastructure-as-code lifecycle, from initial provisioning to ongoing maintenance.
IaC in production: best practices
1. Version and review like application code
All IaC code resides in Git. Every change goes through a pull request reviewed by at least one peer. Feature branches isolate ongoing changes. Tags mark stable versions.
2. Test the infrastructure
Tools like Terratest (Go) or Kitchen-Terraform allow you to write automated tests that verify the actual behavior of the infrastructure after an apply operation. This is the equivalent of unit tests for Infrastructure as Code (IaC) code.
3. Detect and correct configuration drift
Configuration drift occurs when the actual state of the infrastructure deviates from the state described in the code. Terraform detects this drift during each plan. Drift detection tools like driftctl allow for continuous monitoring of the gap between the code and reality.
4. Integrate IaC into CI/CD
Each change to the IaC code automatically triggers a Terraform plan in the CI/CD pipeline, the result of which is displayed in the pull request for review. The apply is triggered automatically or manually after approval, depending on the risk level of the change.
5. Manage secrets properly
Passwords, tokens, and API keys should never appear in plain text in IaC code. Use HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault to externalize secrets and inject them dynamically at runtime.
Smile and IaC: our DevOps expertise
At Smile, we have been practicing and supporting the adoption of infrastructure as code since its inception. Our expertise covers Terraform for multi-cloud provisioning (AWS, Azure, GCP, sovereign cloud), Ansible for configuration and deployment, and the integration of these practices into complete CI/CD pipelines.
We support both teams starting with IaC (existing system audit, implementation of the first Terraform modules, training of engineers) and those seeking to industrialize their existing practices (testing, drift detection, secret management, GitOps).
Our conviction: a coded infrastructure is a controlled infrastructure. Everything else is hope.
Are you looking to adopt Infrastructure as Code in your organization? Discover our DevOps and IaC approach .
Frequently Asked Questions about Infrastructure as Code
Should we choose between Terraform and Ansible?
No. The two tools are complementary and cover different areas. Terraform excels at provisioning cloud resources (VMs, networks, databases). Ansible excels at configuring systems and deploying applications on those resources. Combining the two covers the entire infrastructure lifecycle. Most mature DevOps teams use both in a pipeline.
What should be done if the Terraform state is corrupted?
A corrupted Terraform state is one of the most stressful incidents for an Infrastructure as Code (IaC) team. Prevention involves three measures: storing the state in a secure remote backend (S3, Azure Blob, Terraform Cloud) with versioning enabled, enabling state locking to prevent concurrent modifications, and never manually modifying the state except as a last resort using Terraform state commands. In case of corruption, snapshots of the remote backend allow for restoring a previous version.
Does IaC work with on-premises infrastructure?
Yes. Terraform has providers for VMware, Proxmox, Nutanix, and most on-premises virtualization solutions. Ansible is even better suited to on-premises environments because it only requires SSH connectivity to the target machines. On-premises Infrastructure as Code (IaC) is often the starting point for organizations that then want to migrate to the cloud gradually and in a controlled manner.
How to quickly build an IaC team?
Three steps enable rapid skills development. First, start with Ansible, which has a shallow learning curve thanks to its YAML syntax. Next, introduce Terraform within a limited cloud environment (a development environment) so the team can learn to manage state and plans safely. Finally, scale up with testing and CI/CD once the fundamentals are mastered. HashiCorp and Red Hat certification courses are available for teams that want to structure their learning.