Infrastructure as Code Pitfalls and How to Avoid Them - Part 1
April 05, 2021

Tim Davis
env0

Infrastructure as Code. It's not a totally new concept, but it isn't something that everyone is doing at this point. Some have been doing it for a long time. Some have just started the journey. And some have no clue what it even is.

We're going to break it down a bit today, and talk about what it is and some of the common issues, or pitfalls, that come along with it.

What kind of pitfalls can come up?

I have great news for you... The answer is "a lot."

It's not very good news, I guess. But as long as you take the time to consider all your options, and plan accordingly, you can mitigate just about any issues that come up.

So, why is there a lot that can go wrong? It's because of the nature of Infrastructure as Code (IaC). It's infrastructure and it's code. That means you take all the pitfalls that can come along with infrastructure and add them to all the pitfalls that can come along with code.

Infrastructure as Code creation, and management, seems to be the most successful when it is a joint effort between the development team and the infrastructure ops team. DevOps … get it? When this isn't a collaborative effort, infrastructure configuration issues can come up.

Dev and Ops each have their own areas of expertise. That's not to say that people in one don't understand the other. It just means they are experienced in their area. So why not benefit from the knowledge and experience of both?

Infrastructure Pitfalls

The first big pitfall is choosing the wrong framework for your IaC needs. Most major cloud providers have their own specialized framework.

For example, Cloud Formation on AWS, and ARM templates on Azure. These are great if you are 100% dedicated to that cloud. But if you ever decide to migrate or go multi-cloud, your existing IaC configurations can't be used on the new cloud. There are some tools to convert, but this problem can be easily solved by choosing a cloud-agnostic framework from the beginning. Some frameworks have the ability to deploy to pretty much any cloud provider, and even control other pieces of the infrastructure and SaaS tools.

Infrastructure teams usually don't just spin up resources and delete them at will. Generally, lots of variables come into play. Capacity planning or cost analysis, for example. This is to control over or under-provisioning the needed resources, or even overrunning the cloud budget. This pitfall can be mitigated by the Ops team being involved in the creation of the IaC configuration files, or by helping to manage and govern the self-service of the IaC deployments done by the development team.

Another infrastructure pitfall is going to be security. In the past, lots of development teams had the luxury of secure development sandboxes. No real need to involve security until the time when their project is being turned over from development to production, at which point then security was involved as an afterthought.

By shifting security left with IaC in your deployment process, you can work to mitigate security risks and misconfigurations before they happen. Utilizing tools like Open Policy Agent for Policy as Code can help you ensure that no deployment of IaC resources ever happens when the code files contain infrastructure security misconfigurations. Open Policy Agent will parse your IaC configuration files and check them against Policy as Code files that you create to set up the guardrails of your deployments.

Go to: Infrastructure as Code Pitfalls and How to Avoid Them - Part 2, covering the pitfalls of code.

Tim Davis is a DevOps Advocate at env0
Share this

Industry News

April 15, 2021

Docker announced general availability of the Docker Desktop for Mac [Apple Silicon], enabling developers to leverage the advantages of the latest Macs powered by the M1 chip and extending the reach of their Docker collaborative application development platform to a new architecture.

April 15, 2021

Software AG announced new innovations of its webMethods platform for APIs, Integration and Microservices. With this release, companies can simplify and accelerate their digital transformation initiatives while also speeding their adoption of cloud.

April 15, 2021

Skuid, a toolkit for creating unique and adopted Salesforce experiences, introduced the Skuid Chicago release, a set of features and enhancements providing more declarative support to app designers and builders.

April 14, 2021

SmartBear has integrated TestComplete, its UI test automation tool, with BitBar, its native mobile device cloud.

April 14, 2021

Elastic announced an expanded strategic partnership with Confluent to deliver the best integrated product experience to the Apache Kafka and Elasticsearch community.

April 14, 2021

Threat Stack announced its ability to support AWS Graviton2-based instances through the Threat Stack Cloud Security Platform.

April 13, 2021

Broadcom and Google Cloud announced a strategic collaboration to accelerate innovation and strengthen cloud services integration within the core software franchises of Broadcom.

April 13, 2021

Nylas announced the launch of Components, JavaScript UI/UX solutions that allow developers to bring productivity features to market faster without needing to design front-end elements from scratch.

April 13, 2021

Perforce Software announces its new version control desktop client — Helix Sync — enabling non-coders such as artists and designers to version digital assets, with a simple drag-and-drop UI.

April 12, 2021

ShiftLeft introduced ShiftLeft CORE, a unified code security platform.

April 12, 2021

GrammaTech announced a new version of its CodeSonar SAST (static application security testing) product that helps developers build safer and more secure code without disrupting workflows.

April 12, 2021

Panaya announced a strategic partnership with Being Guided, a Salesforce Consulting Partner, specializing in the CRM and Salesforce ecosystem, to bring Panaya's ForeSight solution to a wider audience.

April 08, 2021

Palo Alto Networks announced the second generation of Checkov, the static analysis tool for infrastructure as code (IaC).

April 08, 2021

Postman now allows any team with up to three members to collaborate in Postman with unlimited shared workspaces and unlimited shared requests at no cost.

April 08, 2021

Taos, an IBM company, has announced 24x5 managed service availability.