# Infrastructure as Code

Source: https://docs.ops0.com/docs/iac/overview

Infrastructure as Code (IaC) in ops0 lets you define, deploy, and manage cloud infrastructure using declarative configuration files. Write code with AI assistance, validate with policies, estimate costs, and deploy with approval workflows.

![ops0 IaC Editor with AI-powered coding](https://docs.ops0.com/images/ai-terraform.png)

## Why IaC with ops0?

- [AI-Powered Editor](https://docs.ops0.com/docs/iac/editor): Write Terraform code from natural language. Describe what you want, get production-ready code.

- [Policy Enforcement](https://docs.ops0.com/docs/iac/deployments/policies): Automatically check security and compliance before deployment. Block violations.

- [Cost Estimation](https://docs.ops0.com/docs/iac/deployments/cost): See monthly cost estimates before you deploy. No surprises on your cloud bill.

- [GitHub Sync](https://docs.ops0.com/docs/iac/github-sync): Two-way sync with your Git repositories. Edit in ops0 or your IDE.

---

## How It Works

### Create Project
Choose your IaC engine (Terraform, OpenTofu, Oxid, or CloudFormation). Pulumi support is upcoming. Configure the state backend and cloud provider.

### Write Code
Use the editor or ask AI to generate infrastructure code.

### Plan
Preview changes before applying them. See resource additions, modifications, and deletions.

### Policy Check
Automatic security and compliance validation against mapped policies.

### Cost Estimation
Review estimated monthly costs for planned infrastructure changes.

### Deploy
Apply changes with optional approval workflows and scheduling.

---

## Supported IaC Engines

| Engine | Status | Description |
|--------|--------|-------------|
| **Terraform** | Available | HashiCorp's infrastructure provisioning tool |
| **OpenTofu** | Available | Open-source Terraform fork, fully compatible |
| **Oxid** | Available | Rust-based IaC engine |
| **Pulumi** | Upcoming | Infrastructure in TypeScript, Python, Go, or C# |
| **CloudFormation** | Available | AWS-native infrastructure templates with change sets and StackSet support |

---

## Key Features

### AI-Powered Coding

Describe infrastructure in plain English and get production-ready code:

```
"Create a VPC with public and private subnets,
NAT gateway, and proper security groups for a
3-tier web application"
```

The AI produces complete, best-practice Terraform code with proper naming, tagging, and security configurations — for example:

**Terraform**

```hcl
# main.tf — VPC with public/private subnets and NAT gateway
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "my-app-vpc"
    Environment = "production"
    ManagedBy   = "ops0"
  }
}

resource "aws_subnet" "public" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 4, count.index)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true

  tags = {
    Name = "public-subnet-${count.index + 1}"
    Tier = "public"
  }
}

resource "aws_subnet" "private" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 4, count.index + 3)
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "private-subnet-${count.index + 1}"
    Tier = "private"
  }
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags   = { Name = "my-app-igw" }
}

resource "aws_eip" "nat" {
  domain = "vpc"
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  tags          = { Name = "my-app-nat" }
}

data "aws_availability_zones" "available" {}
```

**opentofu**

```hcl
# main.tf — same configuration for OpenTofu (fully Terraform-compatible)
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "my-app-vpc"
    Environment = "production"
    ManagedBy   = "ops0"
  }
}

resource "aws_subnet" "public" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 4, count.index)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true

  tags = {
    Name = "public-subnet-${count.index + 1}"
    Tier = "public"
  }
}

resource "aws_subnet" "private" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 4, count.index + 3)
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "private-subnet-${count.index + 1}"
    Tier = "private"
  }
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags   = { Name = "my-app-igw" }
}

resource "aws_nat_gateway" "main" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  tags          = { Name = "my-app-nat" }
}

resource "aws_eip" "nat" {
  domain = "vpc"
}

data "aws_availability_zones" "available" {}
```

### Deployment Scheduling

Schedule deployments for specific times or recurring intervals:

| Mode | Description |
|------|-------------|
| **Immediate** | Deploy now (default) |
| **Scheduled** | Deploy at a specific date and time |
| **Recurring** | Deploy on a cron schedule (e.g., daily, weekly) |

Scheduled deployments run plan + apply at the configured time with all policy checks enforced.

### Project Replication

Replicate an existing IaC project across cloud providers or regions:

### Select Source Project
Choose the project to replicate.

### Configure Target
Select the target cloud provider, region, and account.

### Cost Estimation
View estimated costs for the replicated infrastructure before proceeding.

### Generate
ops0 produces adapted Terraform code for the target environment.

The Replication Wizard supports cross-cloud replication (e.g., AWS to GCP) with intelligent resource mapping.

### Variable Graph

Visualize Terraform variable and resource dependencies as a directed acyclic graph (DAG):

- Navigate to **IaC → Variable Graph** for a project
- See how variables flow into resources and modules
- Identify dependency chains and potential blast radius
- Interactive ReactFlow-based visualization with zoom and pan

### Vulnerability Scanning

ops0 scans IaC code for security vulnerabilities using Checkov:

- Automatic scanning during plan
- Findings categorized by severity
- Links to remediation guidance
- Policy recommendations based on scan results

### Cost Estimation

Before deploying, see estimated monthly costs:

| Resource | Type | Monthly Cost |
|----------|------|--------------|
| EC2 Instance | t3.large | $60.74 |
| RDS Database | db.r5.large | $172.80 |
| NAT Gateway | per hour | $32.40 |
| **Total** | | **$265.94** |

### Real-Time Collaboration

Multiple team members can work on the same project simultaneously:

- Presence tracking shows who is viewing the project
- Changes sync in real-time between collaborators
- Conflict-free collaboration on different files

### Blueprints

Save project configurations as reusable blueprints:

- Save any project as a blueprint template
- Create new projects from blueprints with pre-configured code
- Share blueprints across the organization
- Update blueprints as best practices evolve

### Configuration Approvals

Require approval before deployments execute:

- Configure approval policies per project
- Designated approvers receive notifications
- Approval history tracked in audit logs

---

## State Backend Configuration

Each project stores Terraform state in a configured backend:

| Backend | Description |
|---------|-------------|
| **S3** | AWS S3 bucket with optional DynamoDB locking |
| **Azure Blob** | Azure Storage Account |
| **GCS** | Google Cloud Storage |

---

## Quick Start

### Go to IaC
Navigate to the **IaC** section in the sidebar.

### Click New Project
Click the **+ New Project** button.

### Configure Project
Name the project, select **Terraform** (or another engine when available), and configure the state backend.

### Ask AI
In the editor, use AI to generate code: *"Create an S3 bucket with versioning enabled"*

### Deploy
Review the code, click **Plan**, review the output, then **Apply**.

---

## Related Capabilities

ops0 extends beyond IaC authoring and deployments. These capabilities work alongside your IaC projects:

- [Drift Detection](https://docs.ops0.com/docs/discovery/drift-detection): Detect when live infrastructure drifts from your IaC state across AWS, GCP, and Azure.

- [OPA/Rego Policies](https://docs.ops0.com/docs/policies/overview): Enforce compliance with OPA/Rego policies evaluated against Terraform plans and deployed state.

- [Discovery](https://docs.ops0.com/docs/discovery/overview): Scan existing cloud resources and generate IaC code to bring them under management.

- [Configurations](https://docs.ops0.com/docs/configurations/overview): Manage Ansible playbooks and Kubernetes manifests with AI-driven configuration projects.

- [Workflow Automation](https://docs.ops0.com/docs/workflows/overview): Build multi-step pipelines with triggers, approval gates, and parallel execution.

- [Variable Graph](https://docs.ops0.com/docs/iac/variable-graph): Visualize cross-project dependencies and blast radius across your IaC projects.

- [Resource Graph](https://docs.ops0.com/docs/resource-graph): Browse the dependency graph generated from your Terraform state, with drift overlays.

- [Honeypots](https://docs.ops0.com/docs/iac/honeypots): Deploy decoy resources to detect unauthorized access to your infrastructure.

- [CMDB (Global Inventory)](https://docs.ops0.com/docs/iac/cmdb): Browse every resource across all connected clouds, managed or not, with live cost and drift.

---

## Section Pages

- [Projects](https://docs.ops0.com/docs/iac/projects): Create, manage, and organize IaC projects.

- [Editor](https://docs.ops0.com/docs/iac/editor): AI-powered code editor with autocomplete.

- [Blueprints](https://docs.ops0.com/docs/iac/blueprints): Save and reuse project templates.

- [Deployments](https://docs.ops0.com/docs/iac/deployments): Plan, apply, and schedule infrastructure changes.

- [GitHub Sync](https://docs.ops0.com/docs/iac/github-sync): Two-way sync with Git repositories.

- [Secrets](https://docs.ops0.com/docs/iac/secrets): Manage sensitive values for deployments.

- [Advanced](https://docs.ops0.com/docs/iac/advanced): Variable graphs, replication, and advanced features.