Infrastructure-as-code (IaC) is the practice of defining servers, networks, cloud resources, and deployment settings in versioned configuration files instead of clicking through consoles. Tools such as Terraform, CloudFormation, and Ansible read these files and apply the desired state automatically, making environments repeatable, auditable, and easier to scale.
IaC matters in cyber security because the code that builds infrastructure can also create risk. If an attacker tampers with a dependency, template, or provider, that trusted automation may execute malicious code with the same permissions used for deployments. Defenders use code review, signed artifacts, dependency pinning, least privilege, and pipeline monitoring to protect IaC workflows. In real attacks, IaC is often targeted to reach developer workstations, CI/CD runners, and cloud credentials rather than production systems directly.