SECAI Core · phase 12 of 15 · noun

Infrastructure as code

Provisioning architecture in which deployment of resources is performed by scripted automation and orchestration.

The Explain card

Plain English
Infrastructure as code provisions servers, networks, and services through scripted automation and orchestration rather than manual clicks, so the infrastructure is defined in version-controlled files.
Example
An ML platform's GPU clusters, storage buckets, and IAM roles are declared in Terraform. A pull request that opens a training bucket to the public is caught in code review before it ever deploys.
Why it matters
Reviewable, testable infrastructure means misconfigurations are visible and reversible. Defenders can scan IaC for weaknesses and rebuild compromised environments from a known-good definition.
Hook
Your data center, in a file you can diff.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The platform team uses infrastructure as code to configure cloud networks, servers, and access controls.

Why these words
  • infrastructure French infrastructure, from Latin infra, below, and structura, construction identifies the systems and services managed
  • as Middle English as, from Old English ealswa, all so links the subject to the form in which it is handled
  • code Middle French code, from Latin codex, book or tablet identifies machine-readable instructions as the working form
Where it came from
Origin
English technical phrase formed from infrastructure, as, and code and popularized in DevOps usage
Entered the language
c. 2009
What changed
Infrastructure broadened from foundational public works to computing environments, while code broadened from symbolic systems to computer instructions before the words were joined in this phrase.
How it is spelled
Pattern
The phrase is normally written as three separate lowercase words.
Pattern
Infrastructure retains the Latin-derived prefix infra- and the spelling structure.
Breaks the pattern
The abbreviation IaC uses an internal capital C.

Spelled like

  • policy as code
  • configuration as code
  • security as code
Broken into chunks
  • infra
    • infrared
    • infrasonic
  • structure
    • structural
    • superstructure
  • as code
    • policy as code
    • configuration as code
What it sits beside

Same subject

  • Terraform
  • cloud provisioning
  • configuration management
  • continuous deployment

Same shape

as-code practices

infrastructure automation tools

  • Terraform
  • Pulumi
  • AWS CloudFormation

Where it sits in the deck

Phase 12: Defensive Technologies and Secure Development Practices

Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.

Neighbours in this phase