How can infrastructure changes stay predictable?

Describe the system

Automation is only useful when reality is visible.

Infrastructure as code (IaC) represents networks, routes, policies, services, and dependencies as a desired state. A plan can compare that state with the current environment before an apply changes resources.

The file is not the infrastructure itself. Manual edits, failed deployments, provider defaults, and resources created outside the workflow can create drift. Safe changes therefore depend on state, dependency ordering, review, and a way to reconcile the result with reality.

Resolve the difference

Drift needs a decision before it needs an apply.

First determine whether the live change is intentional, unsafe, or simply missing from the recorded state. If it is valid, update the desired state or import the resource so future plans describe reality. If it is not valid, review the impact and restore the declared state deliberately.

Protect the state and coordinate changes so two actors cannot apply conflicting plans at the same time. A clean plan is not proof that the system is safe; review the change, preserve an audit trail, and verify the live behavior after reconciliation.

Bound the blast radius

A small diff can have a large traffic impact.

Some infrastructure attributes cannot be changed in place, so a plan may replace the resource instead of updating it. For a route, gateway, firewall, or service endpoint, replacement can interrupt existing flows even when the configuration change looks small.

Review whether the platform can create the new resource before removing the old one, whether dependencies can move safely, and how traffic will be verified during the transition. Treat replacement as an operational event, not merely a line in a plan.

Build the model

Four change decisions