Declarative vs imperative IaC in Terraform - Trade-offs & Expert Analysis

Overview - Declarative vs imperative IaC

What is it?

Infrastructure as Code (IaC) is a way to manage and provision computer resources using code instead of manual steps. Declarative IaC means you describe the desired end state of your infrastructure, and the system figures out how to get there. Imperative IaC means you write step-by-step instructions telling the system exactly what to do. Both help automate infrastructure but in different ways.

Why it matters

Without IaC, managing infrastructure is slow, error-prone, and hard to repeat. Declarative IaC solves this by letting you focus on what you want, not how to do it, making infrastructure reliable and consistent. Imperative IaC gives you control but can be complex and fragile. Understanding the difference helps you choose the right approach to build and maintain cloud systems efficiently.

Where it fits

Before this, you should know basic cloud infrastructure concepts and manual resource management. After this, you can learn specific IaC tools like Terraform (declarative) or Ansible (imperative), and how to write and deploy infrastructure code safely.

Mental Model

Core Idea

Declarative IaC describes the desired final infrastructure state, while imperative IaC describes the exact steps to reach that state.

Think of it like...

Declarative IaC is like telling a GPS your destination and letting it find the best route, while imperative IaC is like giving someone turn-by-turn driving directions.

┌───────────────┐       ┌─────────────────────┐
│ Desired State │──────▶│ Declarative IaC Tool │
└───────────────┘       └─────────┬───────────┘
                                   │
                                   ▼
                        ┌─────────────────────┐
                        │ Infrastructure State │
                        └─────────────────────┘


┌───────────────┐       ┌─────────────────────┐
│ Step-by-Step  │──────▶│ Imperative IaC Tool  │
│ Instructions  │       └─────────┬───────────┘
└───────────────┘                 │
                                 ▼
                      ┌─────────────────────┐
                      │ Infrastructure State │
                      └─────────────────────┘

Build-Up - 7 Steps

1

Foundation

What is Infrastructure as Code

Concept: Introduce the basic idea of managing infrastructure using code instead of manual actions.

Infrastructure as Code means writing code to create, update, and delete cloud resources like servers, networks, and databases. This replaces clicking buttons or typing commands manually. It makes infrastructure repeatable and less error-prone.

Result

You understand that infrastructure can be managed by code, making it automated and consistent.

Knowing that infrastructure can be controlled by code opens the door to automation and reliability in cloud management.

2

Foundation

Difference Between Declarative and Imperative

Concept: Explain the two main styles of writing IaC: declarative and imperative.

Declarative IaC means you write what you want the infrastructure to look like at the end. The tool figures out how to get there. Imperative IaC means you write exact commands to create or change resources step by step.

Result

You can tell the difference between describing the goal (declarative) and describing the process (imperative).

Understanding these two styles helps you choose the right approach for your infrastructure tasks.

3

Intermediate

How Declarative IaC Works in Terraform

🤔Before reading on: do you think Terraform requires you to write commands for each step or just the final desired state? Commit to your answer.

Concept: Show how Terraform uses declarative code to manage infrastructure.

In Terraform, you write configuration files describing resources like servers or databases and their desired properties. Terraform compares this desired state with the current state and figures out what changes to make to reach the goal.

Result

Terraform automatically plans and applies only the necessary changes to match your declared infrastructure.

Knowing Terraform focuses on the end state reduces the need to manage complex sequences of commands manually.

4

Intermediate

How Imperative IaC Works in Tools Like Ansible

🤔Before reading on: do you think imperative IaC tools automatically figure out changes or follow exact instructions? Commit to your answer.

Concept: Explain how imperative IaC tools require explicit step-by-step instructions.

Imperative IaC tools like Ansible run tasks in the order you write them. You tell the tool to create a server, then install software, then configure settings. The tool follows these steps exactly, without guessing the final state.

Result

The infrastructure changes exactly as scripted, but you must manage the order and details carefully.

Understanding that imperative IaC requires explicit instructions helps avoid mistakes from missing or wrong steps.

5

Intermediate

Pros and Cons of Declarative IaC

🤔Before reading on: do you think declarative IaC gives you more control or more simplicity? Commit to your answer.

Concept: Discuss the advantages and limitations of declarative IaC.

Declarative IaC simplifies infrastructure management by focusing on the desired state, reducing errors and making changes predictable. However, it can be less flexible for complex sequences or conditional logic.

Result

You see why many teams prefer declarative IaC for standard infrastructure but may need other tools for complex tasks.

Knowing the tradeoffs helps you pick declarative IaC when you want simplicity and reliability.

6

Advanced

Challenges in Imperative IaC at Scale

🤔Before reading on: do you think imperative IaC scales easily for large infrastructures? Commit to your answer.

Concept: Explore why imperative IaC can become complex and error-prone as infrastructure grows.

Imperative IaC requires managing exact steps and their order. In large systems, this leads to fragile scripts that break if steps run out of order or fail. It also makes it hard to know the current state without extra tracking.

Result

You understand why imperative IaC can cause maintenance headaches in big projects.

Recognizing these challenges explains why declarative IaC is often preferred for large, dynamic environments.

7

Expert

Terraform’s State and Plan Mechanism

🤔Before reading on: do you think Terraform applies changes blindly or plans them first? Commit to your answer.

Concept: Deep dive into how Terraform tracks infrastructure state and plans changes before applying.

Terraform keeps a state file recording the current infrastructure. When you run it, Terraform compares this state with your configuration and creates a plan showing what will change. You review and approve this plan before Terraform makes any changes, ensuring safety and predictability.

Result

Terraform prevents accidental changes and helps you understand impact before applying.

Understanding Terraform’s state and plan system reveals why declarative IaC can be both safe and efficient in production.

Under the Hood

Declarative IaC tools maintain a record of the current infrastructure state and compare it with the desired state described in code. They calculate a difference (diff) and generate a plan of actions to reconcile the two. Imperative IaC tools execute commands in the order given without tracking state, relying on the user to manage correctness.

Why designed this way?

Declarative IaC was designed to reduce human error and improve repeatability by focusing on the end goal rather than the process. Imperative IaC reflects traditional scripting and manual operations, offering fine control but requiring more effort to maintain correctness. The tradeoff is between simplicity and control.

┌───────────────┐          ┌───────────────┐          ┌───────────────┐
│ Desired State │─────────▶│ Diff & Plan   │─────────▶│ Apply Changes │
└───────────────┘          └───────────────┘          └───────────────┘
         ▲                                                      │
         │                                                      ▼
┌───────────────┐                                         ┌───────────────┐
│ Current State │────────────────────────────────────────▶│ Updated State │
└───────────────┘                                         └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does declarative IaC require you to write every step explicitly? Commit to yes or no.

Common Belief: Declarative IaC means you must write all the steps to create infrastructure.

Reality: Declarative IaC only requires you to describe the desired final state; the tool figures out the steps.

Why it matters: Believing this leads to unnecessary complexity and defeats the purpose of declarative IaC.

Quick: Do imperative IaC tools automatically detect and fix drift? Commit to yes or no.

Common Belief: Imperative IaC tools automatically detect differences between desired and actual infrastructure and fix them.

Reality: Imperative IaC tools run commands as given and do not track or fix drift automatically.

Why it matters: Assuming automatic drift correction causes unexpected infrastructure mismatches and failures.

Quick: Is declarative IaC always simpler and better than imperative? Commit to yes or no.

Common Belief: Declarative IaC is always the best choice because it is simpler and less error-prone.

Reality: Declarative IaC can be less flexible for complex workflows where imperative control is needed.

Why it matters: Ignoring this can lead to forcing declarative IaC where imperative scripting would be more effective.

Quick: Can Terraform apply changes without a plan? Commit to yes or no.

Common Belief: Terraform applies changes immediately without showing what will happen first.

Reality: Terraform generates a plan first, which you review and approve before applying changes.

Why it matters: Misunderstanding this can cause fear or misuse of Terraform, missing its safety features.

Expert Zone

1

Terraform’s state file is a single source of truth but can become a bottleneck or cause conflicts in team environments if not managed properly.

2

Imperative IaC scripts can be wrapped in idempotent tasks to mimic declarative behavior, but this requires careful scripting and testing.

3

Declarative IaC tools often support limited conditional logic; complex workflows may require combining declarative and imperative approaches.

When NOT to use

Declarative IaC is not ideal when you need precise control over the order of operations or complex conditional logic. In such cases, imperative tools like Ansible or scripting languages are better. Conversely, imperative IaC is less suitable for large, dynamic environments where state tracking and drift detection are critical.

Production Patterns

In production, teams use Terraform for core infrastructure provisioning with state locking and remote backends for collaboration. Imperative tools handle configuration management and application deployment steps. Combining both approaches in pipelines balances control and simplicity.

Connections

Functional Programming

Declarative IaC shares the declarative style of functional programming, focusing on what to do rather than how to do it.

Understanding declarative IaC helps grasp functional programming concepts like immutability and pure functions, which also emphasize describing outcomes over steps.

Project Management

Imperative IaC resembles detailed project plans with step-by-step tasks, while declarative IaC is like setting project goals and letting teams decide how to achieve them.

This connection shows how different management styles affect complexity and flexibility in both infrastructure and projects.

Cooking Recipes

Imperative IaC is like following a recipe step-by-step, while declarative IaC is like telling a chef the dish you want and letting them decide the process.

This cross-domain link helps understand the tradeoff between control and flexibility in instructions.

Common Pitfalls

#1 Writing imperative commands inside a declarative tool configuration.

Wrong approach:

resource "aws_instance" "example" {
provisioner "local-exec" {
command = "echo 'Step 1: Create instance'"
}
# Trying to script steps imperatively inside Terraform
}

Correct approach:

resource "aws_instance" "example" {
ami = "ami-123456"
instance_type = "t2.micro"
# Declare desired resource properties only
}

Root cause:

Confusing declarative syntax with imperative scripting leads to misuse and complexity.

#2 Running imperative IaC tasks without checking current state.

Wrong approach:

- name: Install package
apt:
name: nginx
state: present
# No check if nginx is already installed, blindly runs every time

Correct approach:

- name: Ensure nginx is installed
apt:
name: nginx
state: present
# Idempotent task that only changes if needed

Root cause:

Not understanding idempotency causes unnecessary changes and errors.

#3 Ignoring Terraform plan before apply.

Wrong approach:

terraform apply -auto-approve
# Applies changes immediately without review

Correct approach:

terraform plan
terraform apply
# Review plan output before applying changes

Root cause:

Skipping plan removes safety checks and can cause unexpected infrastructure changes.

Key Takeaways

Infrastructure as Code automates cloud resource management by using code instead of manual steps.

Declarative IaC focuses on describing the desired final state, letting tools handle the process.

Imperative IaC requires explicit step-by-step instructions, giving fine control but more complexity.

Terraform is a popular declarative IaC tool that uses state and plans to safely apply changes.

Choosing between declarative and imperative IaC depends on the task complexity, control needs, and team workflow.