State, plan/apply, modules và policy
IaC tạo reviewable desired infrastructure, nhưng state, provider credentials và destructive plans trở thành critical assets.
Lifecycle
Code/config → init providers/modules → refresh/read state → plan diff → policy/approval → apply → state update. Plan có thể stale nếu state/real world đổi; serialize applies/locking và re-plan near execution.
State
State map logical resources to provider IDs/attributes and may contain sensitive data. Remote encrypted backend, locking, least access, versioning/backup. Không sửa state thủ công trừ recovery procedure; import/move commands preserve ownership.
Modules/environments
Small versioned modules with explicit inputs/outputs; avoid mega-module. Separate state/blast radius per environment/account/subscription; promotion of module versions, not copy-paste. Provider/version lock.
Drift and policy
Detect drift scheduled; decide import/revert/accept. Policy-as-code checks public exposure, encryption, tags, regions, IAM and destructive changes. Break-glass console change must reconcile back to code.
Secrets and destroy
Reference external secret, avoid values in code/plan logs/state when possible. Protect critical resources/deletion; preview replacements, data migration and dependencies. IaC destroy is authorized destructive action, not cleanup convenience.