IaC environments

IaC environments separate dev, staging, and production through stacks, accounts, projects, variables, or directories. The goal is repeatability without giving every environment identical risk, scale, or permissions.

| Pattern | When it fits | |---------|--------------| | Separate state per env | Clear blast-radius boundaries | | Workspaces | Lightweight env switching (watch access) | | Directory per env | Explicit promotion with review | | Separate cloud accounts | Strong isolation for production |

Promotion flow should be reviewed: plan in CI, apply gates for production, and drift detection on a schedule.

On interviews: workspaces vs separate state, promotion flow, least privilege, drift detection, and approval gates for production applies.

Common pitfalls: copy-pasted environment code drifts silently; one state file shared across environments.

The trade-off is DRY convenience versus isolation and governance clarity.

Checklist:

• Separate state per environment.
• Promote reviewed changes deliberately.
• Detect drift regularly.
• Scope IAM and secrets per environment.