What is infrastructure as code, and why use it?

What is the difference between declarative and imperative IaC?

A declarative definition states the end result you want, and the tool works out the steps. An imperative script lists the steps to run. Most modern tools are declarative, because re-running them is safe: they change only what differs from the desired state.

What are the main benefits?

Environments become repeatable, so staging can match production. Every change is recorded in version control, reviewed before it is applied, and can be rolled back. It also shortens recovery, because a lost environment can be rebuilt from the files.

What is drift, and how do you handle it?

Drift is the gap that opens when someone changes a resource by hand and the files no longer describe reality. Detect it by comparing the real state with the code on a schedule, and then either bring the code up to date or put the resource back. Restricting console access reduces it.

How should state and secrets be handled?

Many tools keep a state file recording what they created. Store it in a shared, access-controlled location with locking, since it may contain sensitive values. Keep secrets in a secret manager and reference them, rather than writing them into the files.

What is a safe change process?

Run a plan or preview that shows what will change, have a person review it, apply it from a pipeline rather than a laptop, and add policy checks that block risky changes such as public storage. Small, frequent changes are easier to review than large ones.

Where do you start?

Pick one non-critical environment and define it in code, then expand. Begin by importing existing resources rather than rebuilding them, and agree naming and module conventions early so teams do not diverge.

IICTP is an independent technical credentialing body.