Design Infrastructure as Code - System Design | WinJob

IaC Context and Platform Goals

An enterprise Infrastructure as Code platform lets hundreds of teams provision VPCs, clusters, databases, and IAM through versioned templates—not tickets. Interviewers want plan/apply discipline, remote state, blast-radius control, and auditability across AWS, GCP, and Azure.

Problem framing

Git is the source of truth; merges trigger plan, gated apply per environment
Remote state with locking prevents split-brain writes
Module registry shares golden paths (network, EKS/GKE, RDS/Cloud SQL)
Target: p95 plan feedback < 90s; prod applies auditable and reversible via Git revert

Design choices

Separate plan (read-only) from apply (mutating) with explicit approval on prod
Shard state by env/region/account to reduce lock contention and blast radius
OIDC federation to workers—no long-lived cloud keys in CI
Policy engine evaluates plan output before any cloud mutation

Deep dive

For IaC Context and Platform Goals, explain how HashiCorp Terraform Enterprise, AWS Control Tower + CFN StackSets, and Pulumi Service scale plan concurrency. Cover state corruption recovery, import workflows for brownfield, and why terraform apply must never run without a fresh plan artifact tied to the same commit.

javaOne Dark Pro

1 public final class PlanGate {
2   public boolean allowApply(boolean planApproved, boolean lockHeld, boolean policyPass) {
3     return planApproved && lockHeld && policyPass;
4   }
5 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass
4 class StateLock:
5     workspace: str
6     holder: str
7  
8 def can_acquire(active_holder: str | None, requester: str) -> bool:
9     return active_holder is None or active_holder == requester

typescriptOne Dark Pro

1 interface ApplyRequest {
2   workspaceId: string;
3   commitSha: string;
4   planArtifactId: string;
5 }
6  
7 export function canApply(req: ApplyRequest, policyOk: boolean): boolean {
8   return policyOk && req.planArtifactId.length > 0 && req.commitSha.length > 0;
9 }

Interviewer positioning

Anchor on blast radius, state safety, and segregation of duties. Reference how Netflix, Airbnb, and large banks run federated IaC with central policy planes.

How to open this one

The framing that lands for IaC is desired-state reconciliation with a durable plan/apply boundary: you declare infrastructure, the tool diffs declared against actual and shows a plan, and only then mutates real resources behind a locked state file. Lead with why the state file and its lock are the crown jewels — concurrent applies corrupting state is the classic outage — and the failure story that proves it: a drifted resource is caught on the next plan and reconciled rather than silently diverging. That shows you understand IaC is about convergence, not scripts.

Key Highlights

•Declarative desired state with plan/apply and remote state locking
•Modules pin versions; workspaces isolate dev/staging/prod
•Drift detection reconciles live cloud vs Git truth

1	public final class PlanGate {
2	public boolean allowApply(boolean planApproved, boolean lockHeld, boolean policyPass) {
3	return planApproved && lockHeld && policyPass;
4	}
5	}

1	from dataclasses import dataclass
2
3	@dataclass
4	class StateLock:
5	workspace: str
6	holder: str
7
8	def can_acquire(active_holder: str \| None, requester: str) -> bool:
9	return active_holder is None or active_holder == requester

1	interface ApplyRequest {
2	workspaceId: string;
3	commitSha: string;
4	planArtifactId: string;
5	}
6
7	export function canApply(req: ApplyRequest, policyOk: boolean): boolean {
8	return policyOk && req.planArtifactId.length > 0 && req.commitSha.length > 0;
9	}