There is a specific moment infrastructure as code exists to prevent: the one where staging stopped matching production months ago, nobody knows which change did it, and the only person who might remember has left.
What we put in code
Networking, compute, databases, storage, identity, DNS, certificates and alerting rules. If it can be created in a console, it should exist in a repository instead, so the diff of a change is reviewable before it happens.
Modules, not copy-paste
Environments share modules and differ by variables. Production gets bigger instances and stricter retention; it does not get a separate hand-written definition that will drift within a quarter.
State is treated seriously
Remote state with locking, separate state per environment, and no manual edits. Plans run automatically on a pull request so a reviewer sees exactly what will change, and apply happens from the pipeline with an approval step on production.
Secrets stay out
Values that must not be in version control live in a secrets manager and are referenced, not stored. That includes the ones people assume are harmless, like a webhook URL that turns out to be an unauthenticated write endpoint.
Adopting it on an existing estate
Most of our clients already have infrastructure that was clicked into being. We import it in stages rather than rebuilding everything at once: the risky, shared parts first, the quiet corners later. It is slower and it does not require a migration weekend.
Applies to AWS, Google Cloud and the container platform under Kubernetes and Docker.