Infrastructure as Code (IaC) maturity model

IaC Level -1: Regressive

Processes unrepeatable, poorly controlled, and reactive

Limited infrastructure is provisioned and managed as code
Infrastructure provisioning still requires many manual processes
Infrastructure code is not written using industry-standard tooling and patterns
Infrastructure code not built, unit-tested, provisioned and managed, as part of a pipeline
Infrastructure code, processes, and procedures are inconsistently documented, and not available to all required parties

Processes documented and partly automated

All infrastructure code and configuration are stored in a centralized version control system
Testing, provisioning, and management of infrastructure are done as part of automated pipeline
Infrastructure is deployable as individual components
Leverages programmatic interfaces into physical devices
Automated security inspection of components and dependencies
Self-service CLI or API, where internal customers provision their resources
All code, processes, and procedures documented and available
Immutable infrastructure and processes

Automated processes applied across whole application lifecycle

Processes measured and controlled

Uses infrastructure definition files
Capable of automated rollbacks
Infrastructure and supporting systems are highly available and fault tolerant
Externalized configuration, no black box API to modify configuration
Fully monitored infrastructure with configurable alerting
Aggregated, auditable infrastructure logging
All code, processes, and procedures are well documented in a Knowledge Management System
Infrastructure code uses declarative versus imperative programming model, maybe…

Focus on process improvement