1 min lesson
Pick the tool to the layer
Pick two rows from the table in "Pick the tool to the layer" and explain the choice each one supports.
Step 1 of 2
Pick the tool to the layerTerraform/Pulumi vs. Ansible
- Tool
- Terraform / Pulumi
- Model
- Declarative, state-tracked, desired-state
- Best fit in IT
- SaaS + cloud config where a provider exists: Okta-as-code, Google Workspace, GitHub orgs, AWS/GCP
- Watch-out
- State file is sensitive and must be locked + secured; provider coverage varies by app
- Tool
- Ansible
- Model
- Imperative-ish, agentless, push over SSH
- Best fit in IT
- Server and Linux-fleet state, package/config management, runbook-style orchestration
- Watch-out
- Not truly stateful - converges on run, but won't flag out-of-band drift the way a plan does
| Tool | Model | Best fit in IT | Watch-out |
|---|---|---|---|
| Terraform / Pulumi | Declarative, state-tracked, desired-state | SaaS + cloud config where a provider exists: Okta-as-code, Google Workspace, GitHub orgs, AWS/GCP | State file is sensitive and must be locked + secured; provider coverage varies by app |
| Ansible | Imperative-ish, agentless, push over SSH | Server and Linux-fleet state, package/config management, runbook-style orchestration | Not truly stateful - converges on run, but won't flag out-of-band drift the way a plan does |
Rule of thumb: Terraform/Pulumi for things with an API and a provider; Ansible for getting boxes into a known configuration.
You don't have to choose only one. A common setup is Terraform managing the Okta tenant and Google Workspace, with Ansible handling Linux server baselines, all in the same repo behind the same review gate.