Terraform Fundamentals - What is Infrastructure as Code (IaC)?

Learn what Infrastructure as Code (IaC) is and why it matters for red team operations.

Traditionally, setting up infrastructure meant manually provisioning servers, configuring networking, setting up permissions, and adjusting settings through web dashboards or CLI commands. This process was not only time-consuming and error-prone, but it also lacked consistency and version control. Enter Infrastructure as Code—or IaC.

Infrastructure as Code is the practice of managing and provisioning infrastructure through machine-readable definition files, rather than manual processes. It treats infrastructure the same way we treat application code: you write it, store it in version control, review it through pull requests, and apply changes in a predictable, automated fashion. Using IaC, spinning up a full cloud environment can be as simple as writing a few configuration files and running a single command.

Follow my journey of 100 Days of Red Team on WhatsApp, Telegram or Discord.

For example, with Terraform you can define an EC2 instance in AWS like this:

resource "aws_instance" "kali_box" {
  ami           = "ami-0a0b913ef3249b655"
  instance_type = "t2.micro"
}

This small block of code defines a virtual machine and its configuration. Once defined, Terraform can create, update, or destroy that machine for you.

So, what problem does IaC really solve? For one, it removes the manual labor from infrastructure management. It allows teams—whether engineering, DevOps, or offensive security—to automate the deployment of complex systems reliably and quickly.

Now, you might be wondering,Why should red teams care about IaC? Isn’t that more of a DevOps thing?

Actually, the benefits are even more compelling for offensive security work. With IaC, red teams can build disposable infrastructure that spins up and tears down in minutes—perfect for short-lived C2 servers or redirectors. You can clone lab environments, replicate client cloud configurations for testing, or simulate real-world misconfigurations without burning hours setting things up manually. IaC is also key for integrating infrastructure into CI/CD pipelines, which opens up new attack surfaces and persistence mechanisms that are increasingly relevant in cloud-native organizations.

IaC tools like Terraform also let you use the same code across different environments (like dev, staging, or prod) and even across multiple cloud providers. And since it's just code, you can store it in Git, audit changes, collaborate with others, and reuse components through modules.

Terraform uses a declarative configuration language called HCL (HashiCorp Configuration Language), supports multiple cloud platforms like AWS, Azure, and Google Cloud, and has a massive ecosystem of providers—even for services like GitHub, Slack, and Kubernetes.

TL;DR
Infrastructure as Code (IaC) lets you define and manage your cloud infrastructure using code instead of clicking through web dashboards. It is repeatable, can be version-controlled, and increasingly useful for red teams too.

Follow my journey of 100 Days of Red Team on WhatsApp, Telegram or Discord.