# Infrastructure as Code — First Principles

## 1. The Principles

### P1. Declarative Intent
Describe the desired state, not the steps to reach it. The tool
reconciles current → desired. Imperative scripts describe how;
declarative config describes what.

### P2. Idempotence
Applying the same configuration twice yields the same result. A
second `apply` with no changes is a no-op, not an error. Idempotence
is what makes `plan` trustworthy.

### P3. State is Truth
The state file is the authoritative record of what the tool believes
exists. Drift between state and reality is a bug to be reconciled,
not tolerated. Lose state, lose the ability to reason about
infrastructure.

### P4. Plan Before Apply
Preview every change before mutating real infrastructure. `plan` is
the contract review; `apply` is the signature. No `apply` without a
read `plan`. The plan is the rollback rehearsal.

### P5. Version Everything
Configuration, state, providers, and modules are all versioned and
reproducible. A commit pins a complete, rebuildable world. Pin
providers; pin module sources; never `latest`.

### P6. Modules Compose
Encapsulate repeatable patterns as versioned modules. Compose
modules; do not copy them. A module is the unit of reuse, review,
and versioning — the IaC expression of composition.

### P7. Least Privilege Providers
Provider credentials are scoped to the minimum needed for the
declared resources. No account-wide admin keys in CI. One credential
per environment, per boundary.

### P8. Remote State with Locking
State is stored remotely with locking. Local state is for a single
developer on a throwaway sandbox. Concurrent `apply` without a lock
is data corruption waiting to happen.

### P9. Drift is Recoverable
`plan` detects drift; `apply` reconciles it. Manual mutation of
managed infrastructure is an incident, not a shortcut. Drift is
expected; unreconciled drift is the bug.

### P10. Secrets Never in Code
Secrets come from providers, external secret stores, or environment
variables — never hardcoded in HCL, never committed to the repo,
never written to state in plaintext. State is a secret-bearing
artifact; treat it accordingly.