Infrastructure as Code with Terraform: From Zero to Production

Infrastructure as Code (IaC) treats cloud resources—VMs, databases, load balancers—as code that can be versioned, reviewed, and deployed through CI/CD. Terraform by HashiCorp is the most widely adopted IaC tool, supporting 1000+ providers including AWS, GCP, Azure, and Cloudflare.

Core Terraform Concepts

• Providers: Plugins for cloud APIs (aws, google, kubernetes).
• Resources: Individual infrastructure components (aws_instance, aws_rds_cluster).
• State: Terraform's record of managed infrastructure—must be stored remotely (S3 + DynamoDB lock) in teams.
• Modules: Reusable infrastructure packages.

A Complete Flask App Infrastructure

module "vpc" {
  source = "./modules/vpc"
  cidr   = "10.0.0.0/16"
}

module "rds" {
  source          = "./modules/rds"
  instance_class  = "db.t4g.medium"
  database_name   = "mirahlabs"
  subnet_ids      = module.vpc.private_subnet_ids
}

module "ecs_service" {
  source      = "./modules/ecs"
  image       = "ghcr.io/mirahlabs/api:latest"
  port        = 5001
  cpu         = 512
  memory      = 1024
  db_url      = module.rds.connection_string
}

Remote State with S3

terraform {
  backend "s3" {
    bucket         = "mirahlabs-tfstate"
    key            = "production/terraform.tfstate"
    region         = "ap-south-1"
    dynamodb_table = "terraform-locks"
  }
}

Workspaces for Multi-Environment

Use Terraform workspaces to manage separate state for staging and production from the same configuration. Combine with variable files (staging.tfvars, production.tfvars) for environment-specific values.

Production Terraform Infrastructure Config

Below is a Terraform configuration snippet implementing secure VPC subnets, an Auto Scaling Group, and auto-scaling triggers based on CPU utilization:

# Security Group for ECS Task Service
resource "aws_security_group" "ecs_tasks" {
  name        = "mirahlabs-tasks-sg"
  description = "Allow traffic from load balancer only"
  vpc_id      = var.vpc_id

  ingress {
    protocol        = "tcp"
    from_port       = 8080
    to_port         = 8080
    security_groups = [aws_security_group.lb.id]
  }
  egress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# ECS Fargate Auto Scaling policy
resource "aws_appautoscaling_policy" "ecs_policy_cpu" {
  name               = "ecs-cpu-scaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = "service/${var.cluster_name}/${var.service_name}"
  scalable_dimension = "ecs:service:DesiredCount"
  service_namespace  = "ecs"

  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageCPUUtilization"
    }
    target_value = 65.0
  }
}

Cloud Infrastructure Performance Profile

Below is a comparative latency and throughput profile of this infrastructure pattern deployed under a simulated load of 10,000 concurrent requests:

US & UK DevOps Governance & Infrastructure Security

Automating infrastructure and deployment workflows must respect regional privacy laws. Under the UK GDPR and US California Consumer Privacy Act (CCPA), system administrators must ensure that data pipelines respect strict boundaries regarding where user telemetry and system logs are stored (data residency). Implementing secure deployment methods (such as the NIST Secure Software Development Framework - SSDF) ensures that pipeline secrets are securely managed in systems like HashiCorp Vault, and that container configurations undergo automated security scanning before being shipped to production environments.