DevOps Engineer interview question
What makes infrastructure as code maintainable?
Maintainable IaC uses small owned modules, explicit inputs and outputs, pinned providers, remote state, automated formatting and validation, reviewed plans, policy checks, drift detection, and documentation of lifecycle and migration.
Direct answer
What a strong answer covers
How it works
Maintainable infrastructure code looks like maintainable application code. Modules are small, owned by a team, and expose explicit inputs and outputs rather than reaching into each other. Providers and modules are pinned so a plan does not change because a new version appeared. Formatting, validation, and policy checks run in CI, plans are reviewed in pull requests, and applies happen only through automation. Drift detection compares reality with code on a schedule and flags manual changes. Documentation covers the lifecycle: how to add an environment, how to rotate a credential, and how to retire a module without stranding resources.
Example
A platform team publishes a versioned vpc module with documented variables and outputs; product teams compose it with their own service modules in an environment repository. Renovate opens pull requests for provider updates, tfsec and OPA policies reject public buckets and unencrypted volumes in CI, and a nightly drift job posts any manually changed security group to the owning team’s channel.
Common mistakes
- Copying the same 300 lines into every environment instead of a module.
- Applying from laptops so nobody knows what version of the code is live.
- Never detecting drift and discovering a hand-edited firewall rule during an incident.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.