IaC Governance Glossary
Key terms in infrastructure as code governance, security and AI-assisted automation, explained.
A
Agentic AI governance
Controls for AI agents that act on their own, such as committing code or changing infrastructure.
AI code governance
Policies and automated checks that hold AI-written code to the same standards as code written by people.
AI coding agent
An AI system that completes multi-step coding tasks with limited human input.
Ansible
Red Hat's open source, agentless IT automation tool, driven by YAML files called Playbooks.
Ansible Automation Platform (AAP)
Red Hat's enterprise platform for running Ansible at scale, with a web UI, access control and support.
Ansible check mode (dry run)
Ansible's dry run, which predicts what a Playbook would change without changing anything.
Ansible Collection
A versioned package of Ansible modules, plugins, roles and Playbooks.
Ansible Galaxy requirements.yml
The file that lists the Collections and roles an Ansible project depends on.
Ansible inventory
The list of hosts and host groups that Ansible can automate.
Ansible module
A reusable unit of code that performs one specific action on a managed host.
Ansible Molecule
An open source framework for testing Ansible roles, Playbooks and Collections on temporary hosts.
Ansible Playbook
A YAML file that defines the tasks Ansible runs against a group of hosts.
Ansible role
A standard package of tasks, variables, templates and files that can be reused across Playbooks.
Ansible Tower and AWX
Red Hat's former web UI for Ansible, now automation controller in AAP; AWX is its open source upstream.
Ansible variable precedence
The order Ansible uses to decide which value wins when a variable is defined in several places.
ansible-core
The minimal engine of Ansible: its language, runtime, command-line tools and builtin modules.
ansible.cfg
Ansible's configuration file, which sets defaults for every Ansible command.
Automated code review
Using tools to check code changes for bugs, security issues and policy violations without waiting for a human reviewer.
C
CI/CD gating
A pipeline step that stops a change from moving forward unless it passes defined checks.
CI/CD security
Protecting the CI/CD pipeline itself and using it to block insecure code before deployment.
CIS Benchmark
Consensus-based secure configuration guidelines published by the Center for Internet Security.
Cloud governance
The policies and controls an organization uses to manage cloud resources securely, compliantly and cost-effectively.
Compliance as code
Turning regulatory and industry requirements into automated, repeatable checks.
Configuration drift
The growing gap between the configuration defined in code and what's actually running.
D
Day 2 operations
Everything that happens after a system is deployed, from patching and upgrades to configuration changes.
Deprecated module (Ansible)
An Ansible module marked for removal in a future ansible-core or Collection release.
Deterministic vs probabilistic verification
Fixed rules that always return the same result, versus model-based checks whose answers can vary.
DevOps pipeline
The automated sequence of steps that takes a code change from commit to production.
DevSecOps
Making security a shared, automated part of the DevOps pipeline instead of a separate final review.
F
FQCN (fully qualified collection name)
The full namespace.collection.name of an Ansible module, plugin or role.
G
Generative AI governance
The framework of policies and controls an organization uses to adopt and manage generative AI tools.
H
HashiCorp Sentinel
HashiCorp's policy-as-code framework that checks Terraform runs between plan and apply.
I
IaC scanning
Automated analysis of infrastructure code files for misconfigurations, security risks and policy violations.
IaC security
Finding and preventing security problems in infrastructure code before it's deployed.
Infrastructure as code (IaC)
Managing servers, networks and cloud resources through versioned, machine-readable files instead of manual setup.
Infrastructure as code governance
Enforcing an organization's policies on Ansible and Terraform code before that code is executed.
O
Open Policy Agent (OPA)
An open source, general-purpose policy engine that evaluates rules written in Rego.
P
Policy as code
Writing organizational rules as code so they're versioned, reviewed and enforced automatically.
S
SBOM (software bill of materials)
A machine-readable inventory of every component and version in a piece of software.
Secrets detection
Automatically finding passwords, keys and tokens written into code, configuration or commit history.
Shift-left security
Moving security and compliance checks to the earliest stages of delivery: the editor, the commit and CI/CD.
T
Terraform
HashiCorp's infrastructure as code tool for provisioning cloud and on-premises resources from HCL files.
Terraform linting (TFLint)
An open source Terraform linter that catches errors terraform validate misses.
Terraform module
A reusable package of Terraform configuration that groups related resources.
Terraform plan
A preview of every change Terraform will make, shown before anything is applied.
Terraform provider
A plugin that lets Terraform manage resources on a specific platform through that platform's API.
Terraform security
Keeping Terraform code, state and workflows from creating insecure infrastructure or exposing credentials.
Terraform state file
The JSON record that maps Terraform configuration to the real resources it manages.
Terraform variables file (.tfvars)
A file that sets input variable values for a Terraform configuration, usually one per environment.
