0Pricing
DevOps Bootcamp · Lesson

Automating Infrastructure Updates

Implement workflows for safely planning, applying, and destroying infrastructure changes with review and approval steps.

Automating Infrastructure Updates is a free DevOps Bootcamp lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Automate IaC Updates?

Managing infrastructure manually can be slow and error-prone. Infrastructure as Code (IaC) helps by defining your infrastructure in code.

Automating IaC updates with tools like GitHub Actions brings consistency, speed, and reduces human error. It ensures your infrastructure always matches its definition.

The IaC Workflow Lifecycle

Automating IaC follows a clear lifecycle: plan, apply, and sometimes destroy. Each step can be integrated into your CI/CD pipeline.

  • Plan: Review proposed changes without making them.
  • Apply: Implement the planned changes to your infrastructure.
  • Destroy: Remove infrastructure resources (use with extreme caution!).

GitHub Actions helps manage these steps safely.

Planning Changes with Terraform

Before making any changes, it's crucial to know what will happen. Terraform's plan command helps you preview infrastructure modifications.

It compares your desired state (from code) with the current state of your infrastructure and shows you what resources will be added, changed, or destroyed.

Try running these commands in a simple Terraform project:

echo "Initializing Terraform..."
terraform init

echo "Running terraform plan..."
terraform plan

Workflow for `terraform plan`

Let's create a GitHub Actions workflow that automatically runs terraform plan whenever code is pushed to your main branch. This gives you immediate feedback on proposed changes.

The output of the plan can then be reviewed directly in the Pull Request or workflow logs.

name: 'Terraform Plan'

on:
  pull_request:
    branches:
      - main

jobs:
  terraform:
    name: 'Terraform Plan'
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3

    - name: Terraform Init
      id: init
      run: terraform init

    - name: Terraform Plan
      id: plan
      run: terraform plan -no-color

Manual Approval with Environments

Applying infrastructure changes automatically can be risky. GitHub Environments provide a way to add manual approval steps to your workflows.

You can define environments (e.g., "staging", "production") and set rules like requiring specific reviewers or waiting periods before a deployment job can proceed.

This adds a critical human review gate before sensitive operations.

Workflow for Applying Changes

To safely apply changes, we'll configure a workflow that targets a protected GitHub Environment. The job will pause and wait for approval from designated team members.

Only after approval will the terraform apply command execute, updating your infrastructure.

name: 'Terraform Apply'

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: true
        default: 'staging'

jobs:
  terraform:
    name: 'Terraform Apply'
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment }} # Target environment for approval

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3

    - name: Terraform Init
      id: init
      run: terraform init

    - name: Terraform Apply
      id: apply
      run: terraform apply -auto-approve

Safely Destroying Infrastructure

The terraform destroy command permanently removes all resources defined in your Terraform configuration. This is a very powerful and potentially dangerous operation.

It should only be used in specific, controlled scenarios, like tearing down a temporary test environment. Always double-check before proceeding!

Never automate a `destroy` without strong manual gates and multiple confirmations.

echo "Preparing to destroy infrastructure..."
terraform init
terraform plan -destroy
read -p "Are you absolutely sure you want to destroy ALL resources? (yes/no): " CONFIRM
if [ "$CONFIRM" = "yes" ]; then
  echo "Destroying infrastructure..."
  terraform destroy -auto-approve
else
  echo "Destroy operation cancelled."
fi

Controlled Infrastructure Destruction

Even for `destroy`, we can leverage GitHub Environments for an extra layer of protection. This ensures that no one can accidentally or maliciously destroy production resources without proper authorization.

The workflow should require approval and only be triggerable manually, ideally by specific roles.

name: 'Terraform Destroy'

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to destroy'
        required: true
        default: 'staging'

jobs:
  terraform:
    name: 'Terraform Destroy'
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment }} # Target environment for approval

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3

    - name: Terraform Init
      id: init
      run: terraform init

    - name: Terraform Destroy
      id: destroy
      run: terraform destroy -auto-approve

IaC Automation Best Practices

To maintain a robust and secure IaC pipeline:

  • Code Reviews: Always require code reviews for IaC changes.
  • Least Privilege: Grant workflow tokens and service accounts only the minimum necessary permissions.
  • State Locking: Ensure your IaC tool (like Terraform) uses state locking to prevent concurrent modifications.
  • Small, Incremental Changes: Avoid large, monolithic infrastructure updates.
  • Separate Environments: Use distinct environments (dev, staging, prod) with different approval rules.

IaC Workflow Check

You've learned about automating IaC updates with planning, applying, and destroying resources. Now, let's test your understanding of securing these processes.

Recap: Automated IaC Updates

In this lesson, you learned how to automate your Infrastructure as Code workflows using GitHub Actions. We covered:

  • Running terraform plan to preview changes safely.
  • Using GitHub Environments for manual approval gates before applying or destroying infrastructure.
  • Implementing workflows for controlled terraform apply and terraform destroy operations.
  • Key best practices for secure and reliable IaC automation.

Automating IaC helps you manage your cloud resources efficiently and with confidence!

Frequently asked questions

Is the “Automating Infrastructure Updates” lesson free?

Yes — the full text of “Automating Infrastructure Updates” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Automating Infrastructure Updates”?

Implement workflows for safely planning, applying, and destroying infrastructure changes with review and approval steps. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Automating Infrastructure Updates” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. IaC with Terraform and GitHub Actions
  2. Managing Cloud Resources
  3. Automating Infrastructure Updates
  4. Managing Terraform State and Remote Backends
← Back to DevOps Bootcamp