Infrastructure as code
The principle
Cloud resources are defined in files, reviewed in peer review, and applied by an automated process. A manual change in the cloud console is a deviation to document and return to the code.
What it gives in practice
Disaster recovery, identical environments, a history of who changed what and why, and the ability to see exactly what's about to change before it happens.
Also: pricing. You can see in the merge request that someone is asking to raise an expensive resource, before the invoice reveals it.
Pitfalls
A state file saved locally or without a lock — two people running in parallel can destroy an environment. Keep it remote and locked.
Giant modules where any change touches everything. Split by lifecycle: network and databases rarely change, applications frequently.
Going deeper
Run a change plan on every merge request and print the differences in the response. Most infrastructure incidents start with a change nobody understood the scope of, and showing the differences in review prevents them almost entirely.