Infrastructure as Code

IaC is only valuable if the running cloud matches the repo. We take the accounts you have, put the resources that matter under code, and stop the console drift that makes the next change a guess. Tooling follows what you can hire for — Terraform, Bicep, Pulumi, or CloudFormation — not a conference favourite. State is remote, locked, and backed up. Secrets are not in the repo.

Modules capture the patterns you repeat: a service account, a network spoke, a database with backup. Reviews run in CI. Policy as code catches the mistakes you already know (public buckets, open security groups) before apply. We import existing resources when rewrite would be theatre; we rewrite when the click-ops pile is unsafe.

Environments are promoted like application code. A 'terraform apply' from a laptop against production is treated as an incident, not a culture. Documentation is the module README and the pipeline, not a separate novel.

You get a repo that can recreate or change the estate, a team that has applied it, and a drift check. Console remains for break-glass, which is logged. Module versions and environment promotion are reviewed like application code, so a network change is planned, planned-reviewed, and reversible instead of a Friday click in the cloud console that nobody can replay.