Infrastructure as Code and Configuration Management
What the exam tests
Infrastructure as Code and Configuration Management tests declarative provisioning, state management, module reuse, and configuration drift. Expect Terraform or CloudFormation concepts plus configuration tools such as Ansible or Chef.
Core rules
- Declarative IaC describes the desired end state and lets the tool compute the diff; imperative scripts describe steps and are harder to make idempotent.
- Remote state with locking prevents concurrent applies from corrupting state.
- Modules should be versioned and parameterized; environments differ by variables, not by forked code.
- Configuration management handles in-place OS and software state; IaC handles resource lifecycle. Prefer immutable images to reduce drift.
Worked example
A team needs dev, staging, and prod VPCs from one module. Store state in an S3 bucket with server-side encryption and DynamoDB locking; use separate state keys per environment. Run terraform plan in CI, require approval for prod, and apply only from the pipeline. Reasoning: separate state prevents a dev apply from touching prod; locking blocks two pipelines from racing; the plan output is the review artifact.
Traps
Committing .tfstate to Git leaks secrets and causes conflicts. Manual console changes create drift that the next apply may silently revert. No state locking. Using latest module versions in production. Storing secrets in plaintext variable files.