Patterns and practices of IaC
Diving into the world of IaC, it is essential to uncover the patterns and practices that form the backbone of efficient and reliable implementations. In this section, we will explore the fundamental building blocks that contribute to the success of IaC, ensuring a comprehensive understanding of its best practices and a solid foundation for your IaC journey.
Source control and VCS
It is crucial to keep all aspects of your infrastructure, including the smallest scripts and pipeline configurations, in source control or version control systems (VCSs). A version control system is a tool that manages and tracks changes to documents, programs, and other collections of information, often used in software development to maintain a history of code changes.
This practice ensures that you have a record of all changes made to your infrastructure, regardless of how minor they may be. It also simplifies the process of tracking ownership and the history of changes to your infrastructure configurations.
Furthermore, it is important to make the infrastructure code accessible to all members of your organization, including those who do not directly work on the IaC code base. This visibility provides a better understanding of how the infrastructure is provisioned and enables quick troubleshooting of any issues that arise. By reviewing the code, users can gain a deeper understanding of how the infrastructure operates, and even contribute to the development of the infrastructure if they choose to do so.
The visibility and understanding of the applications running on your infrastructure are crucial for managing a successful IT infrastructure. By having a good grasp of how the applications function, you can optimize their performance and ensure that they operate efficiently. By keeping the infrastructure code accessible to all, you can ensure that your entire organization can contribute to maintaining and improving the infrastructure, ultimately leading to better outcomes for your business.
Modules and versions
Creating reusable modules in IaC tools helps with maintenance, readability, and ownership. It keeps changes small and independently deployable and reduces the effect radius.
Refactoring IaC is difficult compared to application development, particularly for critical pieces such as DNS records, network configurations, databases, and so on.
In many organizations, team structures and responsibilities are different, so it will make more sense to separate multiple layers of infrastructure and assign governance to the respective teams. In some cases, there might be some more separated layers needed for cross-functional teams managing both infrastructure and application development.
The following diagram illustrates an example of Amazon EKS deployments, featuring multiple modules for each infrastructure layer and their respective governors. It is important to note that the modules and layers depicted in this diagram may differ depending on your specific setup.
Figure 1.1 – EKS deployment workflow
Versioning for modules is quite important to provide support for multiple versions of services that can operate without breaking the existing production resources.
Documentation
IaC minimizes the need for extensive documentation for infrastructure since everything is codified and stated as a declarative manifest. However, some documentation is needed for better infrastructure provisioning so that consumers can understand and improve the current modules and templates.
Documentation can be challenging to manage, much like code. It is critical to provide sufficient documentation to convey the intended message effectively. However, having more documentation does not necessarily equate to better-quality documentation. In fact, outdated documentation can be more detrimental than having no documentation at all.
IaC documentation must live close to the code. Keep it close so that everyone can update the documentation without unnecessary effort and difficult steps. If you can build good governance automation, documentation creation or updates can be easily tracked and enforced.
An effective approach to managing documentation for IaC is to include a README file within the same repository as the code, rather than using an external platform such as Confluence or a wiki. This approach facilitates updating the documentation during the same commit as the code changes, which is particularly useful as a reminder during the pull request process.
It is also ideal to leverage automated tools to generate documentation from the code or use tests as documentation. By doing so, you can ensure that the documentation stays in sync with the code, reducing the likelihood of inconsistencies and outdated information. This approach can also streamline the documentation process, reducing the need for manual documentation efforts and enabling faster iterations.
Testing
Software testing is the process of executing a program or application with the intent of finding errors. Testing can be done at various levels, from unit testing to integration testing to system testing and acceptance testing.
IaC development is not an easy task. There are many different aspects and considerations that need to be taken into account before, during, and after the development process. One of these considerations is how to test your IaC. Let’s provide you with a basic understanding of the various levels of testing that you need to think about when developing your IaC:
- Static code and analysis
Running quick tests as frequently as possible is crucial for obtaining prompt feedback during the development process. This approach is especially effective when performed on your local machine. There are various integrations available that can automate this process and trigger tests automatically when you save a file in your text editor or IDE.
To perform static analysis, you can use specialized tools such as Terraform Validate or TFLint. These tools enable you to identify issues in your code and configurations promptly, reducing the likelihood of errors and inconsistencies in your infrastructure. By incorporating quick testing and static analysis into your development process, you can streamline the testing process and improve the reliability of your infrastructure.
- Unit testing
Since many IaC tools, such as Terraform and Ansible, operate on a declarative model, unit testing may not always be necessary. However, in some cases, unit tests can be beneficial, particularly when conditionals or loops are involved.
While unit testing may not always be required for IaC, incorporating it where necessary can help to catch potential issues early on in the development process, improving the overall quality of your infrastructure.
- Integration testing
One essential step in ensuring the reliability of your infrastructure is to perform validation testing. This involves provisioning resources in a test environment and verifying whether specific requirements are met. It is crucial to avoid writing tests for things that are already covered by your IaC tool, particularly when working with declarative code.
For example, instead of verifying whether the policies specified in IaC were applied, you should write automated tests to ensure that none of your S3 buckets are public. Similarly, you can test that only specific ports are open across all of your EC2 instances. To perform these tests, you can provision an ephemeral environment that you can later tear down.
Depending on the duration of these tests, you may want to run them after every commit or as nightly builds. By incorporating validation testing into your development process, you can catch potential issues early on, reduce the risk of errors, and ensure the overall reliability of your infrastructure.
- Smoke tests
An additional approach to testing is to provision an environment, deploy a dummy application, and run quick smoke tests to verify that the application has been deployed correctly. Using a dummy application can be helpful in testing scenarios that your actual application may encounter but are not configured for production.
For example, if your application connects to an externally hosted database, you should attempt to connect to it in your dummy application. By doing so, you can gain confidence that the infrastructure you are provisioning is capable of supporting the applications you intend to run on it.
As these tests can be time-consuming, it is advisable to run them after provisioning a new environment and periodically thereafter. By leveraging this testing approach, you can ensure that your infrastructure is capable of supporting your application’s requirements and minimize the risk of errors or issues arising during deployment.
Security and compliance
The definition of IaC is to provide an abstraction layer between the physical infrastructure and the applications that run on top of it. This is done by separating the hardware from the software and by abstracting out all of the tasks that are required to manage the hardware.
IaC can be used by companies for compliance purposes, such as HIPAA, SOX, PCI DSS, and so on. It can also be used for security purposes, such as preventing unauthorized access to data or preventing hackers from accessing sensitive information.
Let’s look at important details of security and compliance.
Identity and access management
Implementing a strong Identity and Access Management (IAM) strategy is essential for safeguarding both your IaC and the infrastructure it provisions. One effective approach is to use Role-Based Access Control (RBAC) for IaC, which can significantly reduce the overall attack surface.
By leveraging RBAC, you can grant just enough permission to your IaC to perform the necessary operations while preventing unauthorized access. This approach helps to minimize the risk of errors or malicious activity, improving the overall security of your infrastructure.
Secrets management
When working with IaC, it is common to require secrets to provision infrastructure. For example, if you are provisioning resources in AWS, you will need valid AWS credentials to connect to it. It is crucial to ensure that you use a reliable secret management tool, such as HashiCorp Vault or AWS Secrets Manager, to manage these sensitive credentials.
In cases where you need to store or output secrets in the state file (although it is advisable to avoid doing so), it is essential to encrypt them to prevent unauthorized access. By encrypting secrets stored in the state file, you can mitigate the risk of exposure in the event of a security breach or unauthorized access.
Security scanning
Performing security scans after provisioning or making changes to infrastructure in a lower or ephemeral environment can help mitigate potential security issues in production. Leveraging tools such as CIS Benchmarks and Amazon Inspector can be effective in identifying common vulnerabilities or exposures and ensuring adherence to security best practices.
By conducting security scans, you can catch potential security issues early on in the development process and prevent them from being carried over to production. This approach helps to minimize the risk of security breaches and protect sensitive data and infrastructure.
Compliance
Compliance requirements are a critical consideration for many organizations, particularly in highly regulated industries such as healthcare or finance. These industries are subject to stricter requirements, including HIPAA, PCI, GDPR, and SOX, to name a few. Traditionally, compliance teams conducted manual checks and filled in paperwork to ensure adherence to these requirements.
However, automation tools such as Chef InSpec or HashiCorp Sentinel can help streamline compliance requirements and improve efficiency. By automating compliance checks, you can run them more frequently and identify issues much faster. For instance, you can incorporate compliance tests into your IaC pipeline by provisioning an ephemeral environment and running tests every time you modify your IaC code. This approach enables you to catch potential compliance issues early on and rectify them before they impact production systems.
