Infrastructure Basics
Compute, storage, networking, IAM fundamentals.
Theory
Infrastructure as Code (IaC) treats infrastructure configuration (servers, networks, databases, DNS) as version-controlled code rather than manually configured systems. Changes go through code review and automated testing before being applied. The infrastructure state is reproducible — destroy and recreate a full environment from source code in minutes.
Key tools by scope: Terraform and Pulumi provision cloud resources (VMs, VPCs, RDS, S3 — the infrastructure layer). Ansible, Chef, and Puppet configure the software inside those machines (install Nginx, create users, manage /etc/). Docker/Kubernetes package and run applications inside the configured infrastructure. Each tool operates at a different layer and they're often combined.
Immutable vs mutable infrastructure: mutable infrastructure (Ansible running on long-lived VMs) changes machines in place — configuration drift accumulates over months. Immutable infrastructure (build a new AMI or Docker image on every change, replace the old one) guarantees reproducibility — every machine started from the same image is identical. Immutable is the preferred pattern for cloud-native teams.
Idempotency: applying the same IaC configuration multiple times produces the same result. Terraform apply is idempotent — if the resource already exists in the desired state, nothing changes. Ansible tasks are designed to be idempotent: install nginx runs apt install nginx --yes which does nothing if nginx is already installed at the right version.
Testing IaC: terratest (Go) programmatically applies Terraform, runs assertions, and destroys the environment. Kitchen-Terraform tests Terraform modules. Checkov and tfsec scan Terraform for security misconfigurations before apply. OPA (Open Policy Agent) enforces organizational policies (no resources without cost tags, no public S3 buckets) as code.
Secrets in IaC: never store secrets in Terraform state or Ansible playbooks committed to Git. Use HashiCorp Vault dynamic secrets (generate short-lived DB credentials on demand), AWS SSM Parameter Store or Secrets Manager (referenced in Terraform data sources, not stored in state), or SOPS-encrypted files for secrets that must live in the repo.
Drift detection: manual changes to infrastructure (someone SSH-ing in and changing a config) cause drift from IaC state. Terraform detects drift on next plan; AWS Config continuously monitors for changes. Eliminate snowflakes (unique, manually configured servers) by enforcing IaC-only changes via lockdown (no console access, IAM deny for manual resource creation by non-Terraform roles).
Architecture Diagram
Users / clients
|
Infrastructure Basics
|
Core services
|
Data + observabilityExamples
# Infrastructure Basics
# Compute, storage, networking, IAM fundamentals.
# Validate in staging before production rollout.Interview Questions
What problem does Infrastructure Basics solve?
It addresses the core use case described in production architecture — map features to reliability, scale, or velocity outcomes.
Key components of Infrastructure Basics?
Identify inputs, outputs, control plane, data plane, and failure domains — interviewers want structured decomposition.
Common production pitfalls?
Misconfiguration, missing observability, no rollback path, and scaling bottlenecks under peak load.
How do you test changes safely?
Staging parity, canary/gradual rollout, automated health checks, and documented rollback.
Metrics to prove success?
Error rate, latency percentiles, throughput, cost, and toil reduction — pick one primary SLO.
Beginner vs advanced concern?
Beginners focus on setup; advanced teams focus on blast radius, security boundaries, and operability at 10× scale.
Best Practices
- Treat Infrastructure Basics config as code with review and CI validation.
- Define SLOs and dashboards before production cutover.
- Document rollback and ownership for on-call.
- Use least privilege for credentials.
Common Mistakes
- Adopting Infrastructure Basics without measurable success criteria.
- No staging environment mirroring production constraints.
- Missing rollback path during incidents.
- Undocumented on-call expectations.
Cheat Sheet
Practical Exercises
Stand up Infrastructure Basics locally or in free tier; document commands and failure recovery.
Introduce misconfiguration; practice detection and rollback under time limit.