Skip to main content
OpsRoadmaps

Checklists / infrastructure-as-code-readiness

Infrastructure as Code Readiness Checklist

Before trusting a definition to represent your estate: state stored safely, plans reviewed before apply, drift detected, ownership tagged, and one environment actually rebuilt from code.

8 steps · 7 required · last reviewed (next review 2027-03-20) · updated 2026-09-20

Related focus areas:InfraOps

Sign in to run this checklist

Run this when infrastructure-as-code adoption is underway but before treating the definition as authoritative. The failure this prevents is the most common one in the discipline: a repository that everyone believes describes production and that quietly diverged from it eighteen months ago.

The rebuild item is the acceptance test for everything above it.

  1. Infrastructure state is stored remotely with locking enabled

    required

    Concurrent applies against shared or local state is a self-inflicted outage with a well-documented history.

  2. The planned change is reviewed before it is applied

    required

    Reading the plan is what catches the destructive diff that nobody intended to author.

  3. Credentials used by the pipeline are scoped and not long-lived personal keys

    required

    An automation identity with unlimited permissions and no expiry is the highest-value credential you own.

  4. Drift between the definition and reality is detected on a schedule

    required

    Without this the repository becomes documentation of intent rather than a description of fact.

  5. Every resource carries an owner tag and unowned resources are swept

    required

    Unclaimed resources are simultaneously an unbounded cost and an unmonitored attack surface.

  6. Environment differences are deliberate and recorded

    required

    "It worked in staging" is usually a difference nobody wrote down.

  7. One complete environment has been recreated from the definition and the gaps closed

    required

    This is the only item that actually proves the definition is complete rather than plausible.

  8. Cost impact is visible at review time rather than on the invoice

    optional

    A change's cost is easiest to question before it is applied.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-20 — adapt them to your own environment.