IaC

In the Ultra Transcenders books

AZ-305AI-300AZ-900AZ-400

Each book explains IaC in context, with comparison tables and the common traps.

Terms in this definition

• Declarative

  Describing the result wanted (as Terraform configurations and Bicep files do) and letting tooling work out the steps. Microsoft favours this over imperative scripting.

• Bicep

  Domain-specific language for declaring Azure infrastructure as code, which is compiled into ARM templates.

• ARM

  Short for Azure Resource Manager, the control plane Azure uses for deploying and managing resources.

Related terms

• Azure Deployment Environments

  Retiring on 22 February 2027 (Microsoft points people to Azure Verified Modules, Bicep or ARM deployments and Azure DevOps or GitHub workflows). Until then, it gives developers self-service app infrastructure built from curated IaC definitions kept in dev center catalogs, governed by platform engineers.

• Azure Pipelines

  CI/CD service within Azure DevOps that deploys applications and infrastructure as code, with environments, approvals and checks.

• Defender for Cloud DevOps security

  Brings GitHub, GitLab and Azure DevOps into Defender for Cloud, showing IaC, dependency, secret and code findings side by side. Problems are caught early, yet deployments that skip the pipeline are not blocked.

• Defender for Cloud pull request annotations

  DevOps security comments on IaC problems, posted only against the lines a pull request changes, in GitHub or Azure DevOps. Defender CSPM is a prerequisite; on Azure DevOps you also need Contributor or Owner rights and a Build Validation policy on main.

• EPAC

  Teams fluent in DevOps and infrastructure as code can pick this open-source tooling over the usual platform options to roll out and look after Azure Policy objects of every kind estate-wide. Microsoft says to weigh it up early, because switching how you govern policy later is costly.

• Microsoft Security DevOps

  Runs security scanners like Checkov, Terrascan and Template Analyzer as part of a pipeline, either as an Azure DevOps task or a GitHub action. Setting categories: 'IaC' restricts it to the IaC scanners.

• Platform automation and DevOps

  One of the Azure landing zone design areas. It brings DevOps tools, templates and ways of working into line with how the landing zone evolves, so the platform is built and updated by pipelines running infrastructure as code.

• Portal accelerator

  For organisations without infrastructure-as-code skills, Microsoft offers this click-through deployment of the reference architecture in the Azure portal. Because it is harder to change and version, and less flexible, than the IaC accelerator, Microsoft recommends moving to IaC.