Declarative vs Imperative IaC

Every Infrastructure as Code tool falls somewhere on a spectrum between two philosophies: declarative and imperative. A declarative tool asks you to describe what you want the end result to look like — 'there should be a web server with this configuration' — and the tool itself figures out the sequence of API calls needed to get there, whether that means creating something new, updating an existing resource in place, or leaving it untouched because it already matches. An imperative tool asks you to describe how to get there — a specific ordered list of steps, like 'create a VPC, then create a subnet inside it, then launch an instance in that subnet.'

Terraform is fundamentally declarative. You write .tf files describing resources, and Terraform's engine computes a dependency graph and an execution plan on every run. If you run terraform apply twice in a row with no configuration changes, the second run does nothing, because the actual infrastructure already matches the desired state — this property is called idempotency. Declarative tools are generally easier to reason about at scale because the configuration is a single source of truth for 'what should exist', rather than a log of historical actions that must be replayed correctly.

Imperative tools and scripts — for example, a Bash script calling the AWS CLI step by step, or older-style Chef recipes — explicitly encode the sequence of operations. This gives fine-grained control over ordering and can be simpler for one-off or highly custom tasks, but it pushes the burden of idempotency onto the script author: if the script is re-run, it must itself check 'does this resource already exist?' before creating it, or it will error out or create duplicates. As infrastructure grows, hand-maintaining that logic across many resources becomes increasingly fragile.

The distinction is not always crisp. Ansible, often called a configuration management tool, supports both styles: many of its modules are declarative ('ensure this package is installed') even though playbooks execute as an ordered list of tasks. Terraform itself has imperative-feeling escape hatches, such as provisioners, which run arbitrary scripts as part of resource creation — a practice generally discouraged because it breaks the clean declarative model and reintroduces the ordering and idempotency problems imperative approaches face.