InfraOps
Owning the infrastructure estate as a defined, versioned artifact: provisioning through code, environment topology that is consistent, drift that is detected, and a clear picture of what exists and what it costs.
Overview
Read the full InfraOps guidance
Capabilities
Drift detection
Detecting divergence between the definition and reality, and reconciling by changing the code rather than the console.
Environment consistency
Environments that match in the ways that matter, with deliberate differences recorded rather than discovered.
Infrastructure as code
Provisioning from version-controlled definitions so the estate can be reproduced, reviewed and recovered.
Resource ownership
Every resource carrying an owner, so unclaimed resources can be found and removed rather than paid for indefinitely.
State management
Storing infrastructure state safely with locking, because a corrupted or shared state file is a self-inflicted outage.
Practices
Plan review before apply
Reading the planned change before applying it, which catches the destructive diff nobody intended.
Restore test
Restoring from backup on a schedule and timing it, which is what separates a backup from a hope.
Unowned resource sweep
Periodically finding resources nobody claims, which are simultaneously a cost and a security exposure.
Metrics
Environment provisioning time
How long it takes to create a complete environment from its definition.
Unit: hours. Good direction: down.
Estate drift findings
Resources differing from their definition at the last drift check.
Unit: resources. Good direction: down.
Infrastructure-as-code coverage
Share of infrastructure resources defined in version-controlled code rather than created by hand.
Unit: percent. Good direction: up.
Restore test success rate
Share of scheduled restore tests that completed successfully within the expected time.
Unit: percent. Good direction: up.
Untagged resource rate
Share of resources with no owner tag, which are simultaneously a cost and a security question.
Unit: percent. Good direction: down.
Tools
Infracost
Cost estimation for infrastructure-as-code changes directly in pull requests.
Visit site ↗OpenTofu
Open-source infrastructure-as-code tool maintained under the Linux Foundation.
Visit site ↗Pulumi
Infrastructure as code expressed in general-purpose programming languages.
Visit site ↗Terraform
Declarative infrastructure as code across cloud providers.
Visit site ↗
Architecture patterns
Reference architectures and their trade-offs live in the blueprints library.
Maturity
- L1 ReactiveThe estate accumulated rather than being designedrequired stage
Resources were created by hand, environments differ unpredictably, and nothing can be recreated from a definition.
- L2 RepeatableCore infrastructure is defined in version-controlled coderequired stage
The most-changed parts of the estate have a definition that can be reviewed before it is applied.
- L3 StandardizedPlan review precedes apply and state is stored safely
Changes are read before they land and state is locked, removing two common self-inflicted outages.
- L4 MeasuredDrift is detected and reconciled through the code
Divergence is found automatically and fixed by changing the definition rather than the console.
- L5 OptimizedEvery resource has an owner and environments are reproducible
Unclaimed resources are swept up, and creating a complete environment is routine rather than a project.
Maturity for infraops is measured, not guessed — every score traces to your answers. See how maturity is scored.
Put it to work
Related Ops disciplines
Sources
- Tier 1 — PrimaryOpenTofu Documentation ↗— OpenTofu / Linux Foundation(verified 2026-09-20)
- Tier 1 — PrimaryTerraform Documentation — State and Locking ↗— HashiCorp(verified 2026-09-20)
- Tier 2 — AuthoritativeCIS Benchmarks ↗— Center for Internet Security(verified 2026-09-20)