IAC
36 bites tagged IAC — interview questions with model answers, and 60-second explainers.
Strategy for large multi-team IaC projects
Versioned reusable modules, state split per environment and component, promotion of identical code via variables, and externalized secrets. scaling IaC organizationally. one giant shared state or secrets in code.
State drift in Terraform
Drift is when live infrastructure diverges from recorded state, usually via manual console changes; detect with plan or refresh, remediate by re-applying or importing. IaC state versus reality. hand-editing state.
What is Infrastructure as Code?
IaC defines infra in version-controlled files, giving repeatability, peer review, and drift-free consistency, unlike error-prone console clicks. the case for declarative infrastructure. calling it mere scripting.
What is IaC and its CI/CD benefits over manual provisioning?
Cover descriptive models, idempotency, and on-demand environments for repeatable CI/CD. Your understanding of IaC as versioned, declarative infrastructure that stops snowflake environments and drift.
What is Infrastructure as Code (IaC), and how does it support CI/CD?
This tests if you link declarative definitions to repeatable pipelines. A strong answer covers idempotence, versioned templates, and preventing snowflake environments. A red flag is calling IaC mere scripting without CI/CD integration.
How would you create and distribute reusable IaC components at scale?
This tests platform engineering governance at scale. A strong answer proposes a versioned module registry, policy-as-code guardrails, automated validation pipelines, and self-service documentation.
How would you integrate automated security scanning for Terraform in CI/CD?
Run Checkov or TFLint in CI to block builds; catch open security groups, missing encryption, secrets in code, and bad IAM. Shift-left security and IaC misconfig detection in CI.
Define configuration drift in IaC. How do you detect and remediate it?
This tests state divergence between declared and live infrastructure. A strong answer defines drift as deviation from the IaC source of truth, proposes automated scanning for detection, and recommends reconciliation or redeployment.
How do you manage secrets within IaC configurations?
This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.
Describe the Terraform workflow from code to live
This tests Terraform workflows beyond local commands. A strong answer covers: version-controlled code, terraform plan for speculative validation, then terraform apply via remote runs with policies. Red flag: only local apply without reviews or remote state.
Explain the difference between declarative and imperative IaC.
Contrast Terraform with Bash or Ansible; note drift detection, idempotency, and state trade-offs. Grasp of desired-state reconciliation versus ordered command execution. Calling one universally better or conflating tool categories.
Configuration Management: Enforcing Desired State
Configuration Management treats your system's setup as code to prevent "configuration drift." It's used to reliably provision servers, deploy apps, and manage fleets, ensuring every component matches its intended design and is reproducible.
Configuration as Code: Version Control for Your Settings
Configuration as Code treats your system settings like source code: defined in files, versioned, and automatically applied. It's used to manage app settings or service credentials across environments, preventing manual errors.
Kubernetes' Declarative Model: Desired vs. Actual State
The declarative model is like telling Kubernetes your destination, not giving it turn-by-turn directions. You define the desired state in a file, and Kubernetes works to make it a reality. This enables self-healing and GitOps.
Configuration Drift: When Live State Betrays Git
Configuration drift is when your live system's state no longer matches its Git source of truth. GitOps tools like Argo CD detect this by constantly comparing live resources to Git, flagging any discrepancies.
Helm Templates: Turning Static YAML into Dynamic Manifests
Think of Helm templating as a mail merge for Kubernetes. It combines static YAML templates with dynamic values to generate manifests for different environments. Use it to manage configurations for dev, staging, and prod.
Pod Security Context: Set Security Rules for Pods
A Pod Security Context defines security settings for all containers in a Pod, like setting permissions for a user group before adding users. Use it to enforce non-root execution or manage shared volume permissions.
Kustomize: Template-Free Kubernetes Configuration
Kustomize is a patch tool for Kubernetes YAML, letting you manage environment-specific configurations without complex templates. Use it to define a base config and apply overlays for dev, staging, and prod. The footgun is treating it like a templating engine.
The Dockerfile: A Recipe for Your Container
A Dockerfile is a text-based recipe for building a Docker image, specifying the OS, code, and dependencies. You use it to create consistent, portable application environments.
IaC for MLOps: Your ML Factory's Blueprint
Treat ML infrastructure—training clusters, model registries, serving endpoints—as code in version-controlled files. This ensures reproducible experiments and consistent deployments across environments.
Policy as Code: Rules as Versioned, Testable Code
Policy as Code (PaC) treats rules like code: versioned, tested, and automated. Instead of manual UI clicks, you define guardrails in a declarative language. Use it in CI/CD to block bad deploys or in Kubernetes to enforce runtime rules.
IaC State: The Map Between Your Code and the Cloud
IaC state is the source of truth mapping your code to real-world resources, acting as your tool's memory. Terraform uses a state file to plan updates, while other tools use a service backend. The footgun: never commit state files to Git; they lack locking and.
AWS SAM: A Shorthand for Serverless on AWS
Think of AWS SAM as a developer-friendly shorthand for defining serverless applications. It simplifies creating Lambda functions and APIs by abstracting away verbose CloudFormation syntax, letting you build and test locally before deploying.
.ebextensions: Infrastructure as Code for Elastic Beanstalk
.ebextensions are config files for customizing the AWS resources in your Elastic Beanstalk environment. Use them to install packages, run commands on instances, or provision related AWS resources.
Get IAC bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.