Spec-Driven Development for Infrastructure as Code — Three Layers and Policy-as-Code

Jaroslaw Wasowski's article, published on Medium, delves into the concept of Spec-Driven Development (SDD) within the realm of Infrastructure as Code (IaC), proposing a three-layered framework for its implementation. The core argument is that while declarative IaC has been a standard for years, true risk reduction comes from moving beyond mere declarations to executable specifications, particularly through policy-as-code. The first layer of SDD for IaC, according to Wasowski, is the declarative nature inherent in existing tools like Terraform, Pulumi, and Kubernetes. These tools allow engineers to define the desired state of infrastructure, and their engines work to achieve that state. In this sense, IaC is already spec-driven by design. However, this layer alone is insufficient for preventing critical errors, as illustrated by scenarios where a deleted state file or a misconfigured bucket can lead to significant outages, even with a 'green' pipeline. The second and most critical layer is policy-as-code. The article strongly advocates for transforming security, cost, and compliance rules—which are often just suggestions when written in prose—into binding, executable code. Tools like Rego or Sentinel enable these rules to be evaluated against infrastructure plans (e.g., `terraform plan`) *before* deployment. This mechanism ensures that any non-compliant infrastructure is automatically rejected, effectively making the specification binding and significantly lowering operational risk. For instance, a rule stating "all S3 buckets must be encrypted" becomes an enforced gate rather than a guideline an AI agent might politely ignore. Finally, the article briefly touches upon a third, more experimental layer: AI-generated IaC. While acknowledging its potential, Wasowski advises against starting with autonomous AI for cloud infrastructure. Instead, he emphasizes that the immediate and most impactful step is to codify existing rules into policy-as-code. This approach establishes a robust foundation, allowing organizations to mature their IaC practices through measurable stages, such as mandating `terraform plan` as a gate on every pull request and ensuring no manual changes are made outside the pipeline. Only after achieving stability in these foundational layers should organizations consider more advanced, AI-driven approaches.