Skip to main content
Cloud & Infrastructure OpsLast reviewed 2026-09-20

InfraOps

Owning the infrastructure estate as a defined, versioned artifact: provisioning through code, environment topology that is consistent, drift that is detected, and a clear picture of what exists and what it costs.

Overview

Read the full InfraOps guidance
WHAT IT IS InfraOps is the ownership of the infrastructure estate as something defined rather than accumulated: provisioning through version-controlled code, consistent environment topology, detection of drift between the definition and reality, and a current picture of what exists, who owns it and what it costs. **Not this:** InfraOps is not CloudOps: it owns the estate's definition and lifecycle wherever it runs — code, topology, drift and inventory — rather than the operation of one cloud provider's services. WHY IT EXISTS Infrastructure created by hand cannot be reproduced, and an estate nobody can reproduce cannot be recovered, audited or reasoned about. The second problem is accretion: environments multiply, staging diverges from production in ways nobody recorded, and the difference surfaces as an incident whose cause is "it worked in staging". Defining the estate as code makes both problems tractable, provided the definition stays true. WHEN TO USE IT Adopt it when environments differ in ways nobody can enumerate, when creating a new environment is a project, or when a console change has already caused an outage. It applies to on-premises estates as much as to cloud ones; the tooling differs and the discipline does not. WHO OWNS IT A platform or infrastructure team owns the modules, the standards and the estate-level view. Service teams own their own infrastructure definitions within those standards. Finance and engineering jointly own the cost picture, which is where this connects to /finops. Someone must own the question "what exists that nobody has claimed", because unclaimed resources are both a cost and a security exposure. WHAT GOOD LOOKS LIKE Environments are created from code, and creating a new one is routine rather than heroic. The definition is authoritative: drift from it is detected and reconciled by changing the code, not by hand. Environments are consistent in the ways that matter, and where they differ the difference is deliberate and recorded. State is stored safely, with locking, because a corrupted or shared state file is a self-inflicted outage. Every resource has an owner tag and unowned resources are found and removed. Changes are reviewed and planned before they are applied. HOW TO IMPLEMENT Bring the estate under code incrementally, starting with what is most often changed rather than what is largest. Import existing resources rather than recreating them. Add drift detection early — it is what stops the definition quietly becoming fiction. Establish tagging and ownership, then run a sweep for what nobody claims; expect to find things. Make plan-and-review a required step before apply, and store state with locking. The migration discipline in /gitops applies directly, and host-level administration remains with /sysops. HOW TO ASSESS YOURSELF Try to recreate one environment from its definition and see what is missing. Ask when drift was last checked. Ask what fraction of resources carry an owner. Take the scored self-assessment at /assess and sequence the gaps with /roadmaps.

Capabilities

  • Drift detection

    Detecting divergence between the definition and reality, and reconciling by changing the code rather than the console.

  • Environment consistency

    Environments that match in the ways that matter, with deliberate differences recorded rather than discovered.

  • Infrastructure as code

    Provisioning from version-controlled definitions so the estate can be reproduced, reviewed and recovered.

  • Resource ownership

    Every resource carrying an owner, so unclaimed resources can be found and removed rather than paid for indefinitely.

  • State management

    Storing infrastructure state safely with locking, because a corrupted or shared state file is a self-inflicted outage.

Practices

  • Plan review before apply

    Reading the planned change before applying it, which catches the destructive diff nobody intended.

  • Restore test

    Restoring from backup on a schedule and timing it, which is what separates a backup from a hope.

  • Unowned resource sweep

    Periodically finding resources nobody claims, which are simultaneously a cost and a security exposure.

Metrics

  • Environment provisioning time

    How long it takes to create a complete environment from its definition.

    Unit: hours. Good direction: down.

  • Estate drift findings

    Resources differing from their definition at the last drift check.

    Unit: resources. Good direction: down.

  • Infrastructure-as-code coverage

    Share of infrastructure resources defined in version-controlled code rather than created by hand.

    Unit: percent. Good direction: up.

  • Restore test success rate

    Share of scheduled restore tests that completed successfully within the expected time.

    Unit: percent. Good direction: up.

  • Untagged resource rate

    Share of resources with no owner tag, which are simultaneously a cost and a security question.

    Unit: percent. Good direction: down.

Tools

  • Infracost

    Cost estimation for infrastructure-as-code changes directly in pull requests.

    Visit site ↗
  • OpenTofu

    Open-source infrastructure-as-code tool maintained under the Linux Foundation.

    Visit site ↗
  • Pulumi

    Infrastructure as code expressed in general-purpose programming languages.

    Visit site ↗
  • Terraform

    Declarative infrastructure as code across cloud providers.

    Visit site ↗

Architecture patterns

Reference architectures and their trade-offs live in the blueprints library.

Maturity

  1. L1 ReactiveThe estate accumulated rather than being designedrequired stage

    Resources were created by hand, environments differ unpredictably, and nothing can be recreated from a definition.

  2. L2 RepeatableCore infrastructure is defined in version-controlled coderequired stage

    The most-changed parts of the estate have a definition that can be reviewed before it is applied.

  3. L3 StandardizedPlan review precedes apply and state is stored safely

    Changes are read before they land and state is locked, removing two common self-inflicted outages.

  4. L4 MeasuredDrift is detected and reconciled through the code

    Divergence is found automatically and fixed by changing the definition rather than the console.

  5. L5 OptimizedEvery resource has an owner and environments are reproducible

    Unclaimed resources are swept up, and creating a complete environment is routine rather than a project.

Maturity for infraops is measured, not guessed — every score traces to your answers. See how maturity is scored.

Put it to work

  • SysOps

    SysOps is a dependency of this area

  • NoOps

    NoOps overlaps with this area

  • CloudOps

    CloudOps complements this area

  • NetOps

    NetOps complements this area

Sources