Automate the infrastructure change process
Most IT organizations have a change management process in place to reduce operations and security risks. Most companies follow the Information Technology Infrastructure Library (ITIL). In ITIL, you have a Request for Change (RFC) that has to be approved by a Change-Advisory Board (CAB). The problem is that approvals by a CAB are related to a bad software delivery performance (see Forsgren N., Humble, J., & Kim, G., 2018).
From a security standpoint, change management and segregation of duties are important, and they are often also required for compliance. The key is again to rethink the underlying principles in a DevOps way.
With IaC and fully automated deployment, there is a complete audit trail for all infrastructure changes. If you have full control over the process, the best thing to do is to set up the CAB as CODEOWNERS for IaC files and do the approvals in pull requests. For simple standard changes on the application layer...
