Infrastructure as Code Glossary · Hosting & Cloud

22 levels of precedence: the order in which Ansible resolves a variable, from command-line values and role defaults up to extra vars, which always win (Push & Events: Ansible and Salt).
Account Factory for Terraform (AFT): AWS's pipeline that vends Control Tower accounts from an account request file and applies customizations to all accounts, a set of them or one (Governance, Guardrails & the Resource Catalog).
Account vending: stamping out a new account, subscription or project through one pipeline that places it in the tree, attaches the baseline and records its owning team (Governance, Guardrails & the Resource Catalog).
Action (Event-driven Ansible): what a matching rule runs, such as run_playbook, run_module or run_job_template, or posting an event or fact to a ruleset (Push & Events: Ansible and Salt).
Advisory (policy): Sentinel's default enforcement level, where a failed policy is allowed and logged as a warning (Testing, Policy, Secrets & IaC Platforms).
Aminator: Netflix's open-source AMI baker, which built an image from a volume created from a base AMI's snapshot, later driven by Netflix's Bakery API (Baking Images: Packer).
Ancestry (images): HCP Packer's record of each image's parent, used to warn when a child is built on an outdated parent and to cascade revocation (Baking Images: Packer).
Ansible: push-based configuration management over SSH from a control node, in YAML, with no agent on managed nodes and ordering across hosts built in (Push & Events: Ansible and Salt).
Ansible Automation Platform: Red Hat's commercial Ansible platform: a job server with RBAC and an API, execution environments and Event-driven Ansible (Push & Events: Ansible and Salt).
Ansible Galaxy: the public hub from which Ansible collections are installed, alongside private Galaxy-compatible servers (Push & Events: Ansible and Salt).
ansible-core: Ansible's runtime and CLI (ansible, ansible-playbook), which the ansible package extends with curated community collections (Push & Events: Ansible and Salt).
ansible-pull: Ansible run in reverse, pulling content from Git on cron, which needs no server but puts credentials on every node and keeps no central record (Push & Events: Ansible and Salt).
Artifact (Packer): the output of one Packer build, for example the AMI ids in each region (Baking Images: Packer).
Atlantis: self-hosted, open-source pull-request automation for Terraform that costs nothing but the server, the floor hosted IaC platforms have to justify (Testing, Policy, Secrets & IaC Platforms).
AWS CDK: AWS's framework for defining infrastructure in general-purpose languages, which synthesizes CloudFormation templates so CloudFormation still does the provisioning (Provisioning: Terraform, OpenTofu & the Alternatives).
AWS Config: AWS's recorded configuration items per resource, with organization aggregators, rule evaluations and retention up to seven years, the inventory under its detective controls (Governance, Guardrails & the Resource Catalog).
AWS Control Tower: AWS's landing zone service, generally available June 24, 2019, with an Account Factory and mandatory, strongly recommended and elective controls that don't bind the management account (Governance, Guardrails & the Resource Catalog).
AWS Controllers for Kubernetes (ACK): one Kubernetes controller per AWS service, managing AWS objects as custom resources on any cluster (Provisioning: Terraform, OpenTofu & the Alternatives).
AWS OpsWorks: AWS's retired service that provided managed Chef and Puppet servers (Chef).
AWS Systems Manager State Manager: AWS's cloud-native convergence, where an association applies an SSM document (such as one that runs Ansible playbooks) to tagged nodes on a schedule (Convergence: CFEngine to Puppet).
AWX: the open-source upstream of Ansible's controller (web UI, REST API and task engine), whose releases are paused during a refactoring (Push & Events: Ansible and Salt).
Azure Automation State Configuration: Microsoft's built-in PowerShell DSC pull server, from which nodes pull configurations and report compliance (Convergence: CFEngine to Puppet).
Azure Machine Configuration: configurations assigned through Azure Policy to Azure and Arc-enabled machines and evaluated by the machine's agent (Convergence: CFEngine to Puppet).
Azure Policy effects: the single effect each Azure Policy definition carries (deny, audit, modify, deployIfNotExists and others), evaluated in a fixed order, with assignments at different scopes combined as cumulative most restrictive (Governance, Guardrails & the Resource Catalog).
Azure Resource Graph: Azure's KQL-queryable index of resources, policy states and 14 days of changes, updated with short latency but not strongly consistent (Governance, Guardrails & the Resource Catalog).
Azure VM Image Builder: Azure's managed image-building service built on HashiCorp Packer, driven by image templates (Baking Images: Packer).
Backends: where Terraform stores and locks the state document, such as the S3 backend with server-side encryption, a KMS key and bucket versioning (Provisioning: Terraform, OpenTofu & the Alternatives).
Backstage: the software catalog Spotify open-sourced on March 16, 2020, now CNCF Incubating, whose entities live in catalog-info.yaml files beside the code with a required owner on each Component (Governance, Guardrails & the Resource Catalog).
Baked image: an image with the software and its configuration already in it, which removes drift by construction but makes every change a rebuild (Baking Images: Packer).
Beacons: Salt monitors run by a minion that fire an event onto the bus when they see something, such as a file change or high load (Push & Events: Ansible and Salt).
Berkshelf: the tool that managed Chef cookbooks and their dependencies with a Berksfile and a lockfile, before Policyfiles (Chef).
Bicep / ARM: Azure's DSL compiled to ARM JSON, with service-held state and what-if previews, and new Azure resource types on day one (Provisioning: Terraform, OpenTofu & the Alternatives).
Bodies: CFEngine's reusable blocks holding the complex attribute sets of promises (Convergence: CFEngine to Puppet).
Buckets and versions: HCP Packer's registry structure: a bucket per image, and an immutable version for each completed build (Baking Images: Packer).
Build (Packer): one source run with its provisioners and post-processors; builds in a template run in parallel unless told otherwise (Baking Images: Packer).
Builder: the Packer plugin component behind a source that creates a machine on one platform and turns it into an image, such as amazon-ebs or googlecompute (Baking Images: Packer).
Bundles: CFEngine's reusable groups of promises (Convergence: CFEngine to Puppet).
Catalog: the graph of resources and their relationships that the Puppet server compiles for one node, plain data that keeps other nodes' code and data off the machine (Convergence: CFEngine to Puppet).
CDKTF: HashiCorp's CDK equivalent that synthesized Terraform configuration from general-purpose languages, since sunset and archived (Provisioning: Terraform, OpenTofu & the Alternatives).
CFEngine: the original convergence tool, in which an agent on every host pulls policy from a policy server and converges itself on an interval (Convergence: CFEngine to Puppet).
Changed: the run status for a convergence run that repaired something (Convergence: CFEngine to Puppet).
Channels: named, movable pointers to image versions in HCP Packer, such as production, so promotion and rollback move a channel while versions stay immutable (Baking Images: Packer).
Checkov: an Apache-2.0 policy scanner with a large built-in policy set for AWS, Azure and Google Cloud that scans Terraform and other configuration (Testing, Policy, Secrets & IaC Platforms).
Chef 360 Platform: Progress's SaaS or self-managed successor to Infra Server, Automate and Supermarket, covering node management, Courier job orchestration, skills and licensing (Chef).
Chef Automate: Chef's dashboards, compliance reporting and workflow product, deprecated with a set end of life (Chef).
Chef Infra: pull-based configuration management in which the node compiles Ruby recipes and converges them in order (Chef).
Chef Infra Client: the Chef agent on every node, which compiles and converges the node's run-list (Chef).
Chef Infra Server: the open-source server that stores cookbooks, node objects, roles, environments and policies and answers search, now deprecated (Chef).
chef-solo: a way to run Chef Infra Client without Chef Infra Server, with cookbooks from a local directory or a tarball URL (Chef).
chef-zero: a lightweight, in-process implementation of the Chef server API backed by the local repository, which local mode points the client at (Chef).
ChefSpec: a unit testing framework for Chef cookbooks that runs a converge in memory and asserts what each resource would have done (Chef).
Cinc: community rebuilds of Chef's open-source code (Client, Workstation, Auditor, Server) without Progress's EULA (Chef).
Classification: the Puppet run step in which the server decides which classes a node gets, from node definitions or an External Node Classifier (Convergence: CFEngine to Puppet).
Cloud Asset Inventory: Google Cloud's inventory of resource metadata, IAM and organization policies, with 35 days of history and export to BigQuery (Governance, Guardrails & the Resource Catalog).
cloud-init: the boot-time agent most Linux cloud images carry, running in stages (Detect, Local, Network, Config, Final) to configure a generic image at first boot (Baking Images: Packer).
CloudFormation: AWS's templating service of JSON or YAML templates with service-held stack state and change sets, AWS only and with no charge (Provisioning: Terraform, OpenTofu & the Alternatives).
CloudQuery: a tool that syncs cloud and SaaS APIs into a SQL destination on a schedule, priced on rows synced (Governance, Guardrails & the Resource Catalog).
CMDB (configuration management database): the IT service management record of configuration items and their relationships, filled from cloud APIs by discovery, the older form of a resource catalog (Governance, Guardrails & the Resource Catalog).
Collection (Ansible): the distribution format for playbooks, roles, modules and plugins together (Push & Events: Ansible and Salt).
Communicator: the mechanism Packer uses to upload files and run scripts on the machine being built, usually ssh or winrm (Baking Images: Packer).
Compile phase: the first phase of a Chef run, in which recipe code runs and each resource it encounters is added to the ordered resource collection (Chef).
Compile versus converge: desired state is compiled into a concrete resource list for one machine and then converged; where the compile happens (server, node or control node) is the biggest architectural difference between tools (Convergence: CFEngine to Puppet).
Conditions (Event-driven Ansible): expressions in a rule evaluated against incoming events, such as event.payload.status == "OK" (Push & Events: Ansible and Salt).
config_revision: the column recording which desired-state revision a convergence run applied: a Policyfile revision_id, a playbook or state-tree commit, or a hash where no id exists (Chef).
Conformance pack: a collection of AWS Config rules and remediation actions deployed as one template to an account and region or across an organization (Governance, Guardrails & the Resource Catalog).
Conftest: a wrapper around Open Policy Agent for testing configuration files against Rego policies, with rules named deny and conftest verify for testing the policies (Testing, Policy, Secrets & IaC Platforms).
Container images (alternative to baking): building an OCI image and running it on a generic VM host, with fast builds and one artifact (Baking Images: Packer).
Control (InSpec): a check that defines a regulatory recommendation or requirement for the state of a system, with an impact score (Chef).
Control node: the machine from which the Ansible CLI tools run against managed nodes (Push & Events: Ansible and Salt).
Convergence: repeated runs that move a machine toward its desired state and then hold it there, acting only on the difference (Convergence: CFEngine to Puppet).
convergence_runs: the table with one row per convergence run per machine: a normalized status, counts, the revision applied and a pointer to the full report (Convergence: CFEngine to Puppet).
Cookbook: Chef's unit of distribution: recipes, attribute files, templates, files, custom resources, libraries and metadata.rb with name, version and dependencies (Chef).
Cookbook version constraints: limits on an environment that keep a new cookbook version moving through test environments before production (Chef).
Corrective control: a guardrail that fixes a resource after the fact, such as Azure Policy remediation or AWS Config remediation, safe for a tag and dangerous for a security group a service depends on (Governance, Guardrails & the Resource Catalog).
Courier: Chef 360's job orchestration, in which jobs are JSON documents split into steps per node and delivered by a pull model (Chef).
Crossplane: a CNCF project that installs providers whose managed resources are Kubernetes custom resources for external objects, reconciled continuously instead of on each apply (Provisioning: Terraform, OpenTofu & the Alternatives).
CSPM (cloud security posture management): detective controls and posture scores run over a cloud's inventory, such as Security Hub CSPM, Defender for Cloud and Security Command Center (Governance, Guardrails & the Resource Catalog).
Custom resource (Chef): the recommended way to write a Chef resource since 12.5: one file with property declarations and action blocks, replacing the resource-plus-provider (LWRP) split (Chef).
Data bags: Chef's global JSON data, each item a document with an id, read by recipes (Chef).
Data source (Packer): a lookup at build time, such as the newest AMI matching a filter or a secret from a secrets manager (Baking Images: Packer).
Dependency lock file: Terraform's .terraform.lock.hcl, which records for each provider the exact version selected, the constraints considered and its checksums (Provisioning: Terraform, OpenTofu & the Alternatives).
Deprecate (image): hiding an image from other accounts' listings and the console while it stays launchable by id, the step before deregistering it (Baking Images: Packer).
Deregister: removing an image for good; the owner pays for its snapshots until it does (Baking Images: Packer).
Desired state: a description of what a machine should be (packages, files, services, users), not the steps to get there (Convergence: CFEngine to Puppet).
Detective control: a guardrail that finds what already exists out of policy, only as good as the inventory under it (Governance, Guardrails & the Resource Catalog).
Distribution configuration: the EC2 Image Builder setting for the regions, KMS keys, cross-account sharing and launch template updates an image goes to (Baking Images: Packer).
Drift: a changed convergence run with no change to the desired state, meaning someone changed the machine and the tool undid it (Convergence: CFEngine to Puppet).
Drift finding: a detected difference between code and what runs, opened with an owner and closed one of three ways: revert it, write it into code, or move the resource out of that state on purpose (Governance, Guardrails & the Resource Catalog).
Driver (Test Kitchen): the platform Test Kitchen creates test machines on, such as Vagrant, EC2, Azure or Docker (Chef).
Dry run: a run that reports what it would change and changes nothing: Puppet's noop, Chef's why-run, Ansible's check mode, Salt's test=True (Convergence: CFEngine to Puppet).
EC2 Image Builder: AWS's managed pipeline producing AMIs and container images from image recipes, with infrastructure and distribution configurations (Baking Images: Packer).
Environment (Chef): a workflow stage such as staging or production, with default and override attributes and cookbook version constraints (Chef).
error-cleanup-provisioner: an optional Packer provisioner that runs only when normal provisioning fails, before the machine shuts down (Baking Images: Packer).
Event-driven Ansible: Ansible's event reaction feature, whose unit is a rulebook of rulesets with sources, rules and actions (Push & Events: Ansible and Salt).
Execution environment: a container image that acts as the Ansible control node, bundling ansible-core, ansible-runner, Python and dependencies (Push & Events: Ansible and Salt).
Execution phase: the second phase of a Chef run, which walks the resource collection in order and changes only the difference from desired state (Chef).
Exemption (Azure Policy): Azure's exception object, a waiver or mitigated category with requester, approver and ticket metadata and an optional expiry, kept for the record after it expires (Governance, Guardrails & the Resource Catalog).
Expected lag (inventory): how stale an inventory source may be and still be trusted; a resource unseen for longer is unconfirmed, not present (Governance, Guardrails & the Resource Catalog).
Exported resources: Puppet's cross-node configuration, in which a node publishes a resource with @@ for other nodes to collect through PuppetDB (Convergence: CFEngine to Puppet).
External Node Classifier (ENC): a program that takes a host name and returns the Puppet classes and parameters the node gets (Convergence: CFEngine to Puppet).
external_ref: the provider's identifier for an object, unique per kind and never reused, so an import, a refresh and an abuse report all resolve to one resource (Provisioning: Terraform, OpenTofu & the Alternatives).
Extra vars: Ansible variables passed with -e, which always win precedence (Push & Events: Ansible and Salt).
Fact gathering: the agent inventorying a machine (OS, kernel, addresses, hardware, custom values) before deciding anything; facts select which desired state applies (Convergence: CFEngine to Puppet).
Failed: the run status for a convergence run that couldn't repair something (Convergence: CFEngine to Puppet).
Fingerprint (Packer): the identifier each packer build run gets in HCP Packer; a build fails when its fingerprint matches an existing, complete version (Baking Images: Packer).
Free strategy: the Ansible strategy that lets each host run to the end of a play as fast as it can (Push & Events: Ansible and Salt).
Fried image: a generic image configured at boot, or continuously, by configuration management (Baking Images: Packer).
Golden image: the approved, built and tested image everything launches from (Baking Images: Packer).
Google Cloud VM Manager OS policies: OS policy assignments that target VMs by labels, OS and zone, enforced by the OS Config agent (Convergence: CFEngine to Puppet).
Grains: facts about a Salt minion (OS, domain, IP address, kernel, custom values), set by the minion and therefore a claim, not proof (Push & Events: Ansible and Salt).
Graph (Terraform): the dependency graph built from configuration and state together, with a node per resource and provider configuration and edges from references and depends_on (Provisioning: Terraform, OpenTofu & the Alternatives).
Guard: a Chef condition on a resource whose effect isn't knowable, not_if to skip when true and only_if to run only when true (Chef).
Guardrail: one rule written in plain words, enforced or checked by some engine at one or more layers: organization, plan time, admission and runtime (Governance, Guardrails & the Resource Catalog).
Guardrail exception: a waiver or mitigation recorded with a category, a reason, an approver who isn't the requester and an end date; an expired one reopens its findings (Governance, Guardrails & the Resource Catalog).
Habitat: Chef's application packaging plus a runtime supervisor, which packaged the application rather than converging the host (Chef).
Handlers (Ansible): tasks that run only when a task reporting "changed" notifies them, once regardless of how many tasks notify them (Push & Events: Ansible and Salt).
Hard mandatory: Sentinel's strictest enforcement level, with no override; the only bypass is removing the policy (Testing, Policy, Secrets & IaC Platforms).
HCP Packer: HashiCorp's registry of image metadata (not images): buckets of versions, channels as named pointers, ancestry and revocation (Baking Images: Packer).
HCP Terraform: HashiCorp's hosted Terraform platform for state, runs, policy and registry, self-managed as Terraform Enterprise, billed hourly per managed resource (Testing, Policy, Secrets & IaC Platforms).
HCSEC-2021-12: the HashiCorp advisory after the Codecov compromise exposed the GPG key that signs its download checksums, which argued for keeping signing keys out of CI that runs third-party code (Testing, Policy, Secrets & IaC Platforms).
HCSEC-2026-23: the HashiCorp advisory for flaws in terraform-mcp-server, the server that lets AI assistants drive Terraform, which could expose or reuse users' Terraform tokens (Testing, Policy, Secrets & IaC Platforms).
Health assessments: HCP Terraform's scheduled drift detection and continuous validation of conditions and check blocks, which never change infrastructure (Governance, Guardrails & the Resource Catalog).
Hiera: Puppet's key-value configuration data, looked up during compilation through a defaults-with-overrides hierarchy (Convergence: CFEngine to Puppet).
Highstate: everything a Salt top file assigns to a minion, applied by running state.apply with no SLS targets (Push & Events: Ansible and Salt).
Idempotence: the property that applying the same desired state twice changes nothing the second time, which each resource implementation must have (Convergence: CFEngine to Puppet).
Idempotent create: the provider API requirement that a retried apply after a timeout doesn't produce a twin, met by a client-supplied idempotency key or an enforced unique name (Provisioning: Terraform, OpenTofu & the Alternatives).
Image families: Google Cloud's pointer to the most recent image in a family; deprecating the newest image rolls the family back to the previous one (Baking Images: Packer).
Image recipe: an EC2 Image Builder definition of a base image plus components, YAML or JSON documents run in build, validate and test phases (Baking Images: Packer).
Immutable server: a server that, once deployed, is never modified, only replaced (Baking Images: Packer).
Import (Terraform): adopting an existing object into state with an import block naming the address and the vendor's identifier or provider-defined identity (Provisioning: Terraform, OpenTofu & the Alternatives).
Infracost: a tool that parses Terraform, CloudFormation and CDK projects or a plan and posts the monthly cost difference on each pull request (Testing, Policy, Secrets & IaC Platforms).
Infrastructure configuration: the EC2 Image Builder setting for the instance type, subnet and IAM role a build runs with (Baking Images: Packer).
InSpec: compliance checks as code, organized as profiles of controls, run separately from the tool that converged the machine (Chef).
Integration tests (IaC): applying a module to a real account and checking the result from outside, which catches provider bugs, API defaults and missing permissions that mocks can't (Testing, Policy, Secrets & IaC Platforms).
Inventory (Ansible): the list of managed nodes from one or more sources, with groups for targeting and assigning variables (Push & Events: Ansible and Salt).
Kept / repaired: CFEngine's outcomes for an evaluated promise (already true, or fixed), after which it is locked for a period so repeated runs don't re-evaluate it (Convergence: CFEngine to Puppet).
Landing zone: the multi-account structure plus the process that decides where new accounts go and what they inherit (Governance, Guardrails & the Resource Catalog).
Landing Zone Accelerator: AWS's pipeline, installed from a CloudFormation template, that deploys a regulated estate's baseline from configuration files (Governance, Guardrails & the Resource Catalog).
Lineage and serial: a Terraform state's fixed identifier and its write counter, which act as optimistic concurrency control: a different lineage is a different state, a lower serial a stale copy (Provisioning: Terraform, OpenTofu & the Alternatives).
Linear strategy: Ansible's default strategy, which runs each task on all hosts in a play before starting the next task (Push & Events: Ansible and Salt).
Local mode: running Chef Infra Client with -z against an in-process chef-zero server backed by the local repository (Chef).
Managed nodes: the servers and devices an Ansible control node targets, which normally don't have Ansible installed (Push & Events: Ansible and Salt).
Managed resource: HCP Terraform's billing unit: a resource with mode = "managed" in HCP-managed state, counted from its first plan or apply and billed hourly (Testing, Policy, Secrets & IaC Platforms).
Management group: Azure's scope above subscriptions, up to six levels deep, where policy assignments attach and are inherited (Governance, Guardrails & the Resource Catalog).
Mandatory (run task): the run task enforcement level whose failure blocks the run, against advisory; the most restrictive wins when several apply (Testing, Policy, Secrets & IaC Platforms).
Master (Salt): the machine running salt-master that orchestrates minions over the event bus (Push & Events: Ansible and Salt).
Masterfiles Policy Framework (MPF): the default policy CFEngine ships, which schedules an agent run every five minutes with a splay (Convergence: CFEngine to Puppet).
Minion: any system or device managed by Salt, usually running salt-minion (Push & Events: Ansible and Salt).
Module (Ansible): the code or binaries Ansible copies to and executes on each managed node for a task (Push & Events: Ansible and Salt).
Moved (Terraform): a moved block that rewrites a resource's state address before planning, so a rename doesn't destroy and recreate the object (Provisioning: Terraform, OpenTofu & the Alternatives).
No-code module: a private-registry module version marked No-code Ready, from which a user creates a workspace and starts its first run without writing Terraform (Governance, Guardrails & the Resource Catalog).
Node object: the Chef server's record of a node: its run-list, environment, normal attributes and last Ohai data (Chef).
Noop: Puppet's mode that partially simulates a run, reporting what each resource would change without touching anything (Convergence: CFEngine to Puppet).
Ohai: Chef's system profiler, which supplies node data such as platform, kernel, network, memory and cloud metadata at the start of a run (Chef).
Open Policy Agent (OPA): a CNCF policy engine that evaluates Rego policies against JSON input, such as a Terraform plan (Testing, Policy, Secrets & IaC Platforms).
OpenBao: the community fork of the last MPL-licensed Vault: a secrets manager with encrypted key-value storage, dynamic secrets, encryption as a service, leases and revocation (Testing, Policy, Secrets & IaC Platforms).
OpenTofu: the MPL-2.0 fork of Terraform under the CNCF, with the same backends and client-side state encryption (Provisioning: Terraform, OpenTofu & the Alternatives).
OpenVox: a community soft fork of Puppet by Vox Pupuli, with the same model under Apache 2.0 (Convergence: CFEngine to Puppet).
Organization Policy (Google Cloud): constraints on what configurations are allowed, managed or custom in CEL, in active or dry-run mode, inherited down the hierarchy and not retroactive (Governance, Guardrails & the Resource Catalog).
Owner (team reference): ownership recorded as a reference to a team that exists, assigned at vending and inherited down, with owner tags generated from it rather than typed (Governance, Guardrails & the Resource Catalog).
Packer: HashiCorp's tool for building machine images from a template across platforms, whose core is under the BSL and whose plugins are MPL (Baking Images: Packer).
Partner provider: a Terraform provider written and maintained by the company whose API it wraps, in the partner's own registry namespace (Provisioning: Terraform, OpenTofu & the Alternatives).
Pillar: Salt data compiled on the master and mapped to minions by a top file, readable only by the minion it is targeted to (Push & Events: Ansible and Salt).
Plan (Terraform): the graph walk with every provider asked what it would do, listing each resource change with its address and actions for review before apply (Provisioning: Terraform, OpenTofu & the Alternatives).
Platform and workload landing zones: Azure's split: one platform landing zone per Entra tenant for governance, security and shared networking, and one workload landing zone per workload (Governance, Guardrails & the Resource Catalog).
Platforms (Test Kitchen): the operating systems a Test Kitchen suite is tested on (Chef).
Playbook: an Ansible YAML file of plays, each mapping a set of hosts to an ordered list of tasks (Push & Events: Ansible and Salt).
Plays: the units of an Ansible playbook, each mapping a set of hosts to an ordered list of tasks (Push & Events: Ansible and Salt).
Policy group: a set of Chef nodes that share the same run-list and cookbooks, to which a Policyfile lock is pushed (Chef).
Policy set: a collection of policies HCP Terraform checks against every run's plan, scoped to the organization, projects, workspaces, Stacks or tagged workspaces (Governance, Guardrails & the Resource Catalog).
Policyfile.lock.json: the Policyfile lock recording every cookbook's version, content identifier and source, the attributes, and the policy's revision_id (Chef).
Policyfiles: Chef's answer to roles, environments and Berkshelf: a policy resolved into a lock and promoted unchanged from policy group to policy group (Chef).
Post-processor: a Packer step that runs on the result after the build and provisioners: compress, checksum, import or record it (Baking Images: Packer).
Precedence (Chef attributes): how Chef resolves a key set by several sources: six types and fifteen levels applied from lowest to highest, with the last one winning (Chef).
Preventive control: a guardrail that refuses the action at request time, such as an SCP or RCP, and needs nothing stored (Governance, Guardrails & the Resource Catalog).
Proactive control: a guardrail that checks a resource before it is provisioned and refuses it, such as a CloudFormation hook (Governance, Guardrails & the Resource Catalog).
Profile (InSpec): a reusable, versioned artifact that organizes multiple InSpec controls, with dependencies (Chef).
Progress: the company that acquired Chef Software and now owns Chef's products (Chef).
Promise: CFEngine's basic statement, made by a promiser (the object it affects) optionally to promisees (the stakeholders) (Convergence: CFEngine to Puppet).
Promisees: the stakeholders a CFEngine promise is made to (Convergence: CFEngine to Puppet).
Promiser: the object a CFEngine promise affects, such as a file or a port (Convergence: CFEngine to Puppet).
Provisioner (Packer): software that installs and configures the running machine before Packer captures it as an image (Baking Images: Packer).
Provisioner (Test Kitchen): the component that applies configuration to a Test Kitchen machine, such as the Chef provisioner resolving cookbooks with Policyfiles or Berkshelf (Chef).
Proxy minion: a Salt minion process that manages a device unable to run a minion itself (Push & Events: Ansible and Salt).
Pull agent and run interval: a daemon on each machine that fetches its desired state and applies it on a timer, so drift is corrected automatically every interval (Convergence: CFEngine to Puppet).
Pulumi: infrastructure as code in general-purpose languages, with state in Pulumi Cloud by default or in a customer-chosen backend, and secrets in state encrypted per stack (Provisioning: Terraform, OpenTofu & the Alternatives).
Pulumi Cloud: Pulumi's hosted state, deployments and secrets (ESC), billed in credits drawn by resource-hours (Testing, Policy, Secrets & IaC Platforms).
Puppet: pull-based configuration management in which the agent sends facts, the server compiles a catalog and the agent applies it on an interval (Convergence: CFEngine to Puppet).
Puppet Forge: the public site where Puppet modules are shared and installed from (Convergence: CFEngine to Puppet).
PuppetDB: the store of the latest facts, catalog and optionally reports for every Puppet node, which also enables exported resources (Convergence: CFEngine to Puppet).
Puppetfile: the file that pins Puppet modules for sites deploying code with r10k or Code Manager (Convergence: CFEngine to Puppet).
Reactor: the Salt master component that maps event tags to reactor SLS files, so an event can trigger a function on minions or the master (Push & Events: Ansible and Salt).
Refresh (Puppet): a resource reacting when a resource it subscribes to or is notify'd by changes, the classic case being a service restarting when its config file changes (Convergence: CFEngine to Puppet).
Refresh (Terraform): a plan asking each provider to read the real object and compare it with the cached attributes in state (Provisioning: Terraform, OpenTofu & the Alternatives).
Remediation task: Azure Policy's job that applies modify or deployIfNotExists to existing resources, running as the assignment's managed identity (Governance, Guardrails & the Resource Catalog).
Removed (Terraform): a removed block that drops an object from state while leaving it running, the declarative way to stop managing something (Provisioning: Terraform, OpenTofu & the Alternatives).
Report (convergence): what a run did per resource (previous and new values, success or failure, timing), the evidence of convergence (Convergence: CFEngine to Puppet).
Required tags: AWS tag policy keys marked mandatory for resource creation (report_required_tag_for, November 20, 2025), enforced in CloudFormation by a managed hook in warn or fail mode (Governance, Guardrails & the Resource Catalog).
Resource Abstraction Layer (RAL): Puppet's split of each resource into a type that names it and its properties, and providers that implement it for one platform (Convergence: CFEngine to Puppet).
Resource address: the key of each object in Terraform state (module path, mode, type, name and index), which moved blocks rewrite (Provisioning: Terraform, OpenTofu & the Alternatives).
Resource catalog: the list of what exists, who owns it and how fresh that knowledge is, joined from IaC state, the cloud inventory and the software catalog; its most useful output is where they disagree (Governance, Guardrails & the Resource Catalog).
Resource control policy (RCP): an AWS Organizations policy, since November 13, 2024, that sets the maximum permissions on resources even for principals outside the organization and grants nothing (Governance, Guardrails & the Resource Catalog).
Resource Explorer: AWS's organization-wide search for resources by name, tag and ID, eventually consistent and free (Governance, Guardrails & the Resource Catalog).
Restricted channel: an HCP Packer channel hidden from viewers, so a version can be tested in a channel such as candidate before promotion (Baking Images: Packer).
Revision ID (revision_id): the identifier of a Chef Policyfile lock, so a node's configuration is an artifact with an id that can be promoted and rolled back (Chef).
Revocation (images): marking an image version unusable, immediately or on a schedule, so no new builds or launches use it, cascading to descendants (Baking Images: Packer).
Role (Ansible): a limited distribution of reusable Ansible content (tasks, handlers, variables, templates, files) imported into a play (Push & Events: Ansible and Salt).
Role (Chef): a job function, with a run-list plus default and override attributes; a node can have several (Chef).
Roster: the Salt SSH file listing target machines, /etc/salt/roster by default (Push & Events: Ansible and Salt).
Rulebook: the unit of Event-driven Ansible, a set of rulesets each with event sources and rules (Push & Events: Ansible and Salt).
Rules (Event-driven Ansible): the parts of a ruleset whose conditions are evaluated against incoming events and which run an action on a match (Push & Events: Ansible and Salt).
Rulesets: groups within an Event-driven Ansible rulebook, each with one or more event sources and rules (Push & Events: Ansible and Salt).
Run tasks: HCP Terraform's integration point that calls an external service at pre-plan, post-plan, pre-apply or post-apply and takes its pass or fail (Testing, Policy, Secrets & IaC Platforms).
Run-list: the ordered list of recipes, named cookbook::recipe, that a Chef node converges (Chef).
Salt: configuration management with a master and minions on an event bus, and agentless operation over SSH (Push & Events: Ansible and Salt).
Salt SSH: running Salt commands and states over SSH without installing a minion, by copying a thin Salt tarball to the target; substantially slower than minions (Push & Events: Ansible and Salt).
SCARLETEEL: an attack in which credentials taken from a cluster node's metadata service read a terraform.tfstate holding a clear-text access key for a second account, the case for keeping state locked down and secret-free (Testing, Policy, Secrets & IaC Platforms).
Scripts against a panel API: imperative calls to a hosting panel's API (such as cPanel's WHM API), with no plan, no state, no graph and invisible drift (Provisioning: Terraform, OpenTofu & the Alternatives).
Sentinel: HashiCorp's policy language in HCP Terraform and Terraform Enterprise, with advisory, soft mandatory and hard mandatory enforcement levels (Testing, Policy, Secrets & IaC Platforms).
Service catalog: a list of what may be created, such as AWS Service Catalog portfolios of CloudFormation or Terraform products, or HCP Terraform no-code modules (Governance, Guardrails & the Resource Catalog).
Service control policy (SCP): an AWS Organizations policy that limits what principals in member accounts can do, with a deny at any level of the tree winning (Governance, Guardrails & the Resource Catalog).
Skills (Chef 360): agents that act on a node in Chef 360, some packaged as Habitat packages (Chef).
Soft mandatory: a Sentinel enforcement level that must pass unless an authorized operator overrides it, which records who overrode a failed policy (Testing, Policy, Secrets & IaC Platforms).
Software catalog: a list of what runs and who owns it, with relations such as ownedBy and dependsOn connecting services to their resources and teams (Governance, Guardrails & the Resource Catalog).
SOPS: a tool that encrypts values inside YAML, JSON, ENV, INI and binary files with a KMS, age or PGP, so an encrypted file can live in the repository (Testing, Policy, Secrets & IaC Platforms).
Spacelift: a hosted orchestration platform for OpenTofu, Terraform, Terragrunt, Pulumi and Kubernetes, with private workers in the customer's own cloud (Testing, Policy, Secrets & IaC Platforms).
Splay: a per-host delay added to a pull agent's run so a fleet doesn't hit the server in the same second (Convergence: CFEngine to Puppet).
Stacks: an HCP Terraform layer above workspaces that declares several components and their deployments across environments or regions in one configuration (Provisioning: Terraform, OpenTofu & the Alternatives).
State encryption: OpenTofu's client-side encryption of state and plan files before they reach any backend, its clearest divergence from Terraform (Provisioning: Terraform, OpenTofu & the Alternatives).
States (Salt): Salt's desired state, written in SLS files (YAML with Jinja) with requisites such as require and watch (Push & Events: Ansible and Salt).
Static checks: credential-free checks against configuration (validate, formatting, policy scanners) that cost nothing to run (Testing, Policy, Secrets & IaC Platforms).
Steampipe: an AGPL-3.0 CLI that exposes 150+ APIs as Postgres foreign tables queried live, with Powerpipe adding open controls (Governance, Guardrails & the Resource Catalog).
Suites (Test Kitchen): run-lists with attributes that Test Kitchen converges and verifies on each platform (Chef).
Supermarket: Chef's cookbook registry, public or run privately by a company (Chef).
Supervisor (Habitat): Habitat's runtime with deployment coordination and service discovery built in, under which Habitat packages run (Chef).
Tag policy: an AWS Organizations policy that standardizes tag keys, case and allowed values; untagged resources aren't evaluated by it (Governance, Guardrails & the Resource Catalog).
Tag (Salt event): the string each event on the Salt event bus carries for filtering, alongside a dictionary of data (Push & Events: Ansible and Salt).
Tags versus labels (Google Cloud): labels are per-resource metadata usable to filter billing; tags are separate, inherited resources usable in IAM and Organization Policy conditions (Governance, Guardrails & the Resource Catalog).
Tasks (Ansible): the ordered steps of a play, each calling a module (Push & Events: Ansible and Salt).
Template (Packer): a Packer configuration, in HCL2 or legacy JSON (Baking Images: Packer).
Terraform: HashiCorp's provisioning tool: HCL configuration, providers over gRPC, customer-held state, and plan then apply, with the largest provider and module ecosystem (Provisioning: Terraform, OpenTofu & the Alternatives).
Terraform policy (tfpolicy): HashiCorp's HCL policy framework, generally available July 16, 2026, that checks actual infrastructure state as well as planned changes (Governance, Guardrails & the Resource Catalog).
Test Kitchen: a test harness that runs infrastructure code on one or more platforms in isolation, configured by a driver, provisioner, platforms, verifier and suites (Chef).
tfsec: a Terraform security scanner now folded into Trivy, which carries the same scanning engine (Testing, Policy, Secrets & IaC Platforms).
Top file: Salt's top.sls, which maps groups of machines to the states they get, per environment (Push & Events: Ansible and Salt).
The transaction (Puppet): the agent converting a catalog into a dependency graph, sorting it and converging each resource; it isn't atomic, so a failure halfway leaves earlier changes (Convergence: CFEngine to Puppet).
Trivy: Aqua's scanner, which absorbed tfsec's Terraform scanning engine (Testing, Policy, Secrets & IaC Platforms).
Type (Puppet): the part of a Puppet resource that names it and its properties, implemented per platform by providers (Convergence: CFEngine to Puppet).
Unchanged: the run status for a convergence run that found every resource already correct (Convergence: CFEngine to Puppet).
Unified Mode: a Chef custom-resource mode that compiles and converges each action block in one pass, so resources run in the order written; the default from Chef Infra Client 18 (Chef).
Unit tests (IaC): tests against a plan or mocked providers that prove a module's logic without creating anything (Testing, Policy, Secrets & IaC Platforms).
Values in the state file: whatever a provider returns is stored in Terraform state and plan files in plain text, and sensitive only redacts it from output, so state must be treated as secret (Testing, Policy, Secrets & IaC Platforms).
Vault: HashiCorp's secrets manager, moved to the BSL with the rest of HashiCorp's products, each release converting to MPL 2.0 after four years (Testing, Policy, Secrets & IaC Platforms).
Verifier (Test Kitchen): the tool that checks a converged Test Kitchen machine, such as InSpec, Cinc Auditor or Serverspec (Chef).
Waiver versus mitigated: the two exception categories: non-compliance temporarily accepted, or the rule's intent met another way through a compensating control (Governance, Guardrails & the Resource Catalog).
Well-Architected review: a check of a workload against a provider's architecture framework, a conversation about decisions rather than an audit, and not a guardrail (Governance, Guardrails & the Resource Catalog).
Why-run mode: Chef's dry run, which runs Chef on a system without the providers modifying it (Chef).
Workspaces (Terraform CLI): several named states for one configuration in one backend, which the docs say are not appropriate for system decomposition (Provisioning: Terraform, OpenTofu & the Alternatives).

22 levels of precedence: the order in which Ansible resolves a variable, from command-line values and role defaults up to extra vars, which always win (Push & Events: Ansible and Salt).
Account Factory for Terraform (AFT): AWS's pipeline that vends Control Tower accounts from an account request file and applies customizations to all accounts, a set of them or one (Governance, Guardrails & the Resource Catalog).
Account vending: stamping out a new account, subscription or project through one pipeline that places it in the tree, attaches the baseline and records its owning team (Governance, Guardrails & the Resource Catalog).
Action (Event-driven Ansible): what a matching rule runs, such as run_playbook, run_module or run_job_template, or posting an event or fact to a ruleset (Push & Events: Ansible and Salt).
Advisory (policy): Sentinel's default enforcement level, where a failed policy is allowed and logged as a warning (Testing, Policy, Secrets & IaC Platforms).
Aminator: Netflix's open-source AMI baker, which built an image from a volume created from a base AMI's snapshot, later driven by Netflix's Bakery API (Baking Images: Packer).
Ancestry (images): HCP Packer's record of each image's parent, used to warn when a child is built on an outdated parent and to cascade revocation (Baking Images: Packer).
Ansible: push-based configuration management over SSH from a control node, in YAML, with no agent on managed nodes and ordering across hosts built in (Push & Events: Ansible and Salt).
Ansible Automation Platform: Red Hat's commercial Ansible platform: a job server with RBAC and an API, execution environments and Event-driven Ansible (Push & Events: Ansible and Salt).
Ansible Galaxy: the public hub from which Ansible collections are installed, alongside private Galaxy-compatible servers (Push & Events: Ansible and Salt).
ansible-core: Ansible's runtime and CLI (ansible, ansible-playbook), which the ansible package extends with curated community collections (Push & Events: Ansible and Salt).
ansible-pull: Ansible run in reverse, pulling content from Git on cron, which needs no server but puts credentials on every node and keeps no central record (Push & Events: Ansible and Salt).
Artifact (Packer): the output of one Packer build, for example the AMI ids in each region (Baking Images: Packer).
Atlantis: self-hosted, open-source pull-request automation for Terraform that costs nothing but the server, the floor hosted IaC platforms have to justify (Testing, Policy, Secrets & IaC Platforms).
AWS CDK: AWS's framework for defining infrastructure in general-purpose languages, which synthesizes CloudFormation templates so CloudFormation still does the provisioning (Provisioning: Terraform, OpenTofu & the Alternatives).
AWS Config: AWS's recorded configuration items per resource, with organization aggregators, rule evaluations and retention up to seven years, the inventory under its detective controls (Governance, Guardrails & the Resource Catalog).
AWS Control Tower: AWS's landing zone service, generally available June 24, 2019, with an Account Factory and mandatory, strongly recommended and elective controls that don't bind the management account (Governance, Guardrails & the Resource Catalog).
AWS Controllers for Kubernetes (ACK): one Kubernetes controller per AWS service, managing AWS objects as custom resources on any cluster (Provisioning: Terraform, OpenTofu & the Alternatives).
AWS OpsWorks: AWS's retired service that provided managed Chef and Puppet servers (Chef).
AWS Systems Manager State Manager: AWS's cloud-native convergence, where an association applies an SSM document (such as one that runs Ansible playbooks) to tagged nodes on a schedule (Convergence: CFEngine to Puppet).
AWX: the open-source upstream of Ansible's controller (web UI, REST API and task engine), whose releases are paused during a refactoring (Push & Events: Ansible and Salt).
Azure Automation State Configuration: Microsoft's built-in PowerShell DSC pull server, from which nodes pull configurations and report compliance (Convergence: CFEngine to Puppet).
Azure Machine Configuration: configurations assigned through Azure Policy to Azure and Arc-enabled machines and evaluated by the machine's agent (Convergence: CFEngine to Puppet).
Azure Policy effects: the single effect each Azure Policy definition carries (deny, audit, modify, deployIfNotExists and others), evaluated in a fixed order, with assignments at different scopes combined as cumulative most restrictive (Governance, Guardrails & the Resource Catalog).
Azure Resource Graph: Azure's KQL-queryable index of resources, policy states and 14 days of changes, updated with short latency but not strongly consistent (Governance, Guardrails & the Resource Catalog).
Azure VM Image Builder: Azure's managed image-building service built on HashiCorp Packer, driven by image templates (Baking Images: Packer).
Backends: where Terraform stores and locks the state document, such as the S3 backend with server-side encryption, a KMS key and bucket versioning (Provisioning: Terraform, OpenTofu & the Alternatives).
Backstage: the software catalog Spotify open-sourced on March 16, 2020, now CNCF Incubating, whose entities live in catalog-info.yaml files beside the code with a required owner on each Component (Governance, Guardrails & the Resource Catalog).
Baked image: an image with the software and its configuration already in it, which removes drift by construction but makes every change a rebuild (Baking Images: Packer).
Beacons: Salt monitors run by a minion that fire an event onto the bus when they see something, such as a file change or high load (Push & Events: Ansible and Salt).
Berkshelf: the tool that managed Chef cookbooks and their dependencies with a Berksfile and a lockfile, before Policyfiles (Chef).
Bicep / ARM: Azure's DSL compiled to ARM JSON, with service-held state and what-if previews, and new Azure resource types on day one (Provisioning: Terraform, OpenTofu & the Alternatives).
Bodies: CFEngine's reusable blocks holding the complex attribute sets of promises (Convergence: CFEngine to Puppet).
Buckets and versions: HCP Packer's registry structure: a bucket per image, and an immutable version for each completed build (Baking Images: Packer).
Build (Packer): one source run with its provisioners and post-processors; builds in a template run in parallel unless told otherwise (Baking Images: Packer).
Builder: the Packer plugin component behind a source that creates a machine on one platform and turns it into an image, such as amazon-ebs or googlecompute (Baking Images: Packer).
Bundles: CFEngine's reusable groups of promises (Convergence: CFEngine to Puppet).
Catalog: the graph of resources and their relationships that the Puppet server compiles for one node, plain data that keeps other nodes' code and data off the machine (Convergence: CFEngine to Puppet).
CDKTF: HashiCorp's CDK equivalent that synthesized Terraform configuration from general-purpose languages, since sunset and archived (Provisioning: Terraform, OpenTofu & the Alternatives).
CFEngine: the original convergence tool, in which an agent on every host pulls policy from a policy server and converges itself on an interval (Convergence: CFEngine to Puppet).
Changed: the run status for a convergence run that repaired something (Convergence: CFEngine to Puppet).
Channels: named, movable pointers to image versions in HCP Packer, such as production, so promotion and rollback move a channel while versions stay immutable (Baking Images: Packer).
Checkov: an Apache-2.0 policy scanner with a large built-in policy set for AWS, Azure and Google Cloud that scans Terraform and other configuration (Testing, Policy, Secrets & IaC Platforms).
Chef 360 Platform: Progress's SaaS or self-managed successor to Infra Server, Automate and Supermarket, covering node management, Courier job orchestration, skills and licensing (Chef).
Chef Automate: Chef's dashboards, compliance reporting and workflow product, deprecated with a set end of life (Chef).
Chef Infra: pull-based configuration management in which the node compiles Ruby recipes and converges them in order (Chef).
Chef Infra Client: the Chef agent on every node, which compiles and converges the node's run-list (Chef).
Chef Infra Server: the open-source server that stores cookbooks, node objects, roles, environments and policies and answers search, now deprecated (Chef).
chef-solo: a way to run Chef Infra Client without Chef Infra Server, with cookbooks from a local directory or a tarball URL (Chef).
chef-zero: a lightweight, in-process implementation of the Chef server API backed by the local repository, which local mode points the client at (Chef).
ChefSpec: a unit testing framework for Chef cookbooks that runs a converge in memory and asserts what each resource would have done (Chef).
Cinc: community rebuilds of Chef's open-source code (Client, Workstation, Auditor, Server) without Progress's EULA (Chef).
Classification: the Puppet run step in which the server decides which classes a node gets, from node definitions or an External Node Classifier (Convergence: CFEngine to Puppet).
Cloud Asset Inventory: Google Cloud's inventory of resource metadata, IAM and organization policies, with 35 days of history and export to BigQuery (Governance, Guardrails & the Resource Catalog).
cloud-init: the boot-time agent most Linux cloud images carry, running in stages (Detect, Local, Network, Config, Final) to configure a generic image at first boot (Baking Images: Packer).
CloudFormation: AWS's templating service of JSON or YAML templates with service-held stack state and change sets, AWS only and with no charge (Provisioning: Terraform, OpenTofu & the Alternatives).
CloudQuery: a tool that syncs cloud and SaaS APIs into a SQL destination on a schedule, priced on rows synced (Governance, Guardrails & the Resource Catalog).
CMDB (configuration management database): the IT service management record of configuration items and their relationships, filled from cloud APIs by discovery, the older form of a resource catalog (Governance, Guardrails & the Resource Catalog).
Collection (Ansible): the distribution format for playbooks, roles, modules and plugins together (Push & Events: Ansible and Salt).
Communicator: the mechanism Packer uses to upload files and run scripts on the machine being built, usually ssh or winrm (Baking Images: Packer).
Compile phase: the first phase of a Chef run, in which recipe code runs and each resource it encounters is added to the ordered resource collection (Chef).
Compile versus converge: desired state is compiled into a concrete resource list for one machine and then converged; where the compile happens (server, node or control node) is the biggest architectural difference between tools (Convergence: CFEngine to Puppet).
Conditions (Event-driven Ansible): expressions in a rule evaluated against incoming events, such as event.payload.status == "OK" (Push & Events: Ansible and Salt).
config_revision: the column recording which desired-state revision a convergence run applied: a Policyfile revision_id, a playbook or state-tree commit, or a hash where no id exists (Chef).
Conformance pack: a collection of AWS Config rules and remediation actions deployed as one template to an account and region or across an organization (Governance, Guardrails & the Resource Catalog).
Conftest: a wrapper around Open Policy Agent for testing configuration files against Rego policies, with rules named deny and conftest verify for testing the policies (Testing, Policy, Secrets & IaC Platforms).
Container images (alternative to baking): building an OCI image and running it on a generic VM host, with fast builds and one artifact (Baking Images: Packer).
Control (InSpec): a check that defines a regulatory recommendation or requirement for the state of a system, with an impact score (Chef).
Control node: the machine from which the Ansible CLI tools run against managed nodes (Push & Events: Ansible and Salt).
Convergence: repeated runs that move a machine toward its desired state and then hold it there, acting only on the difference (Convergence: CFEngine to Puppet).
convergence_runs: the table with one row per convergence run per machine: a normalized status, counts, the revision applied and a pointer to the full report (Convergence: CFEngine to Puppet).
Cookbook: Chef's unit of distribution: recipes, attribute files, templates, files, custom resources, libraries and metadata.rb with name, version and dependencies (Chef).
Cookbook version constraints: limits on an environment that keep a new cookbook version moving through test environments before production (Chef).
Corrective control: a guardrail that fixes a resource after the fact, such as Azure Policy remediation or AWS Config remediation, safe for a tag and dangerous for a security group a service depends on (Governance, Guardrails & the Resource Catalog).
Courier: Chef 360's job orchestration, in which jobs are JSON documents split into steps per node and delivered by a pull model (Chef).
Crossplane: a CNCF project that installs providers whose managed resources are Kubernetes custom resources for external objects, reconciled continuously instead of on each apply (Provisioning: Terraform, OpenTofu & the Alternatives).
CSPM (cloud security posture management): detective controls and posture scores run over a cloud's inventory, such as Security Hub CSPM, Defender for Cloud and Security Command Center (Governance, Guardrails & the Resource Catalog).
Custom resource (Chef): the recommended way to write a Chef resource since 12.5: one file with property declarations and action blocks, replacing the resource-plus-provider (LWRP) split (Chef).
Data bags: Chef's global JSON data, each item a document with an id, read by recipes (Chef).
Data source (Packer): a lookup at build time, such as the newest AMI matching a filter or a secret from a secrets manager (Baking Images: Packer).
Dependency lock file: Terraform's .terraform.lock.hcl, which records for each provider the exact version selected, the constraints considered and its checksums (Provisioning: Terraform, OpenTofu & the Alternatives).
Deprecate (image): hiding an image from other accounts' listings and the console while it stays launchable by id, the step before deregistering it (Baking Images: Packer).
Deregister: removing an image for good; the owner pays for its snapshots until it does (Baking Images: Packer).
Desired state: a description of what a machine should be (packages, files, services, users), not the steps to get there (Convergence: CFEngine to Puppet).
Detective control: a guardrail that finds what already exists out of policy, only as good as the inventory under it (Governance, Guardrails & the Resource Catalog).
Distribution configuration: the EC2 Image Builder setting for the regions, KMS keys, cross-account sharing and launch template updates an image goes to (Baking Images: Packer).
Drift: a changed convergence run with no change to the desired state, meaning someone changed the machine and the tool undid it (Convergence: CFEngine to Puppet).
Drift finding: a detected difference between code and what runs, opened with an owner and closed one of three ways: revert it, write it into code, or move the resource out of that state on purpose (Governance, Guardrails & the Resource Catalog).
Driver (Test Kitchen): the platform Test Kitchen creates test machines on, such as Vagrant, EC2, Azure or Docker (Chef).
Dry run: a run that reports what it would change and changes nothing: Puppet's noop, Chef's why-run, Ansible's check mode, Salt's test=True (Convergence: CFEngine to Puppet).
EC2 Image Builder: AWS's managed pipeline producing AMIs and container images from image recipes, with infrastructure and distribution configurations (Baking Images: Packer).
Environment (Chef): a workflow stage such as staging or production, with default and override attributes and cookbook version constraints (Chef).
error-cleanup-provisioner: an optional Packer provisioner that runs only when normal provisioning fails, before the machine shuts down (Baking Images: Packer).
Event-driven Ansible: Ansible's event reaction feature, whose unit is a rulebook of rulesets with sources, rules and actions (Push & Events: Ansible and Salt).
Execution environment: a container image that acts as the Ansible control node, bundling ansible-core, ansible-runner, Python and dependencies (Push & Events: Ansible and Salt).
Execution phase: the second phase of a Chef run, which walks the resource collection in order and changes only the difference from desired state (Chef).
Exemption (Azure Policy): Azure's exception object, a waiver or mitigated category with requester, approver and ticket metadata and an optional expiry, kept for the record after it expires (Governance, Guardrails & the Resource Catalog).
Expected lag (inventory): how stale an inventory source may be and still be trusted; a resource unseen for longer is unconfirmed, not present (Governance, Guardrails & the Resource Catalog).
Exported resources: Puppet's cross-node configuration, in which a node publishes a resource with @@ for other nodes to collect through PuppetDB (Convergence: CFEngine to Puppet).
External Node Classifier (ENC): a program that takes a host name and returns the Puppet classes and parameters the node gets (Convergence: CFEngine to Puppet).
external_ref: the provider's identifier for an object, unique per kind and never reused, so an import, a refresh and an abuse report all resolve to one resource (Provisioning: Terraform, OpenTofu & the Alternatives).
Extra vars: Ansible variables passed with -e, which always win precedence (Push & Events: Ansible and Salt).
Fact gathering: the agent inventorying a machine (OS, kernel, addresses, hardware, custom values) before deciding anything; facts select which desired state applies (Convergence: CFEngine to Puppet).
Failed: the run status for a convergence run that couldn't repair something (Convergence: CFEngine to Puppet).
Fingerprint (Packer): the identifier each packer build run gets in HCP Packer; a build fails when its fingerprint matches an existing, complete version (Baking Images: Packer).
Free strategy: the Ansible strategy that lets each host run to the end of a play as fast as it can (Push & Events: Ansible and Salt).
Fried image: a generic image configured at boot, or continuously, by configuration management (Baking Images: Packer).
Golden image: the approved, built and tested image everything launches from (Baking Images: Packer).
Google Cloud VM Manager OS policies: OS policy assignments that target VMs by labels, OS and zone, enforced by the OS Config agent (Convergence: CFEngine to Puppet).
Grains: facts about a Salt minion (OS, domain, IP address, kernel, custom values), set by the minion and therefore a claim, not proof (Push & Events: Ansible and Salt).
Graph (Terraform): the dependency graph built from configuration and state together, with a node per resource and provider configuration and edges from references and depends_on (Provisioning: Terraform, OpenTofu & the Alternatives).
Guard: a Chef condition on a resource whose effect isn't knowable, not_if to skip when true and only_if to run only when true (Chef).
Guardrail: one rule written in plain words, enforced or checked by some engine at one or more layers: organization, plan time, admission and runtime (Governance, Guardrails & the Resource Catalog).
Guardrail exception: a waiver or mitigation recorded with a category, a reason, an approver who isn't the requester and an end date; an expired one reopens its findings (Governance, Guardrails & the Resource Catalog).
Habitat: Chef's application packaging plus a runtime supervisor, which packaged the application rather than converging the host (Chef).
Handlers (Ansible): tasks that run only when a task reporting "changed" notifies them, once regardless of how many tasks notify them (Push & Events: Ansible and Salt).
Hard mandatory: Sentinel's strictest enforcement level, with no override; the only bypass is removing the policy (Testing, Policy, Secrets & IaC Platforms).
HCP Packer: HashiCorp's registry of image metadata (not images): buckets of versions, channels as named pointers, ancestry and revocation (Baking Images: Packer).
HCP Terraform: HashiCorp's hosted Terraform platform for state, runs, policy and registry, self-managed as Terraform Enterprise, billed hourly per managed resource (Testing, Policy, Secrets & IaC Platforms).
HCSEC-2021-12: the HashiCorp advisory after the Codecov compromise exposed the GPG key that signs its download checksums, which argued for keeping signing keys out of CI that runs third-party code (Testing, Policy, Secrets & IaC Platforms).
HCSEC-2026-23: the HashiCorp advisory for flaws in terraform-mcp-server, the server that lets AI assistants drive Terraform, which could expose or reuse users' Terraform tokens (Testing, Policy, Secrets & IaC Platforms).
Health assessments: HCP Terraform's scheduled drift detection and continuous validation of conditions and check blocks, which never change infrastructure (Governance, Guardrails & the Resource Catalog).
Hiera: Puppet's key-value configuration data, looked up during compilation through a defaults-with-overrides hierarchy (Convergence: CFEngine to Puppet).
Highstate: everything a Salt top file assigns to a minion, applied by running state.apply with no SLS targets (Push & Events: Ansible and Salt).
Idempotence: the property that applying the same desired state twice changes nothing the second time, which each resource implementation must have (Convergence: CFEngine to Puppet).
Idempotent create: the provider API requirement that a retried apply after a timeout doesn't produce a twin, met by a client-supplied idempotency key or an enforced unique name (Provisioning: Terraform, OpenTofu & the Alternatives).
Image families: Google Cloud's pointer to the most recent image in a family; deprecating the newest image rolls the family back to the previous one (Baking Images: Packer).
Image recipe: an EC2 Image Builder definition of a base image plus components, YAML or JSON documents run in build, validate and test phases (Baking Images: Packer).
Immutable server: a server that, once deployed, is never modified, only replaced (Baking Images: Packer).
Import (Terraform): adopting an existing object into state with an import block naming the address and the vendor's identifier or provider-defined identity (Provisioning: Terraform, OpenTofu & the Alternatives).
Infracost: a tool that parses Terraform, CloudFormation and CDK projects or a plan and posts the monthly cost difference on each pull request (Testing, Policy, Secrets & IaC Platforms).
Infrastructure configuration: the EC2 Image Builder setting for the instance type, subnet and IAM role a build runs with (Baking Images: Packer).
InSpec: compliance checks as code, organized as profiles of controls, run separately from the tool that converged the machine (Chef).
Integration tests (IaC): applying a module to a real account and checking the result from outside, which catches provider bugs, API defaults and missing permissions that mocks can't (Testing, Policy, Secrets & IaC Platforms).
Inventory (Ansible): the list of managed nodes from one or more sources, with groups for targeting and assigning variables (Push & Events: Ansible and Salt).
Kept / repaired: CFEngine's outcomes for an evaluated promise (already true, or fixed), after which it is locked for a period so repeated runs don't re-evaluate it (Convergence: CFEngine to Puppet).
Landing zone: the multi-account structure plus the process that decides where new accounts go and what they inherit (Governance, Guardrails & the Resource Catalog).
Landing Zone Accelerator: AWS's pipeline, installed from a CloudFormation template, that deploys a regulated estate's baseline from configuration files (Governance, Guardrails & the Resource Catalog).
Lineage and serial: a Terraform state's fixed identifier and its write counter, which act as optimistic concurrency control: a different lineage is a different state, a lower serial a stale copy (Provisioning: Terraform, OpenTofu & the Alternatives).
Linear strategy: Ansible's default strategy, which runs each task on all hosts in a play before starting the next task (Push & Events: Ansible and Salt).
Local mode: running Chef Infra Client with -z against an in-process chef-zero server backed by the local repository (Chef).
Managed nodes: the servers and devices an Ansible control node targets, which normally don't have Ansible installed (Push & Events: Ansible and Salt).
Managed resource: HCP Terraform's billing unit: a resource with mode = "managed" in HCP-managed state, counted from its first plan or apply and billed hourly (Testing, Policy, Secrets & IaC Platforms).
Management group: Azure's scope above subscriptions, up to six levels deep, where policy assignments attach and are inherited (Governance, Guardrails & the Resource Catalog).
Mandatory (run task): the run task enforcement level whose failure blocks the run, against advisory; the most restrictive wins when several apply (Testing, Policy, Secrets & IaC Platforms).
Master (Salt): the machine running salt-master that orchestrates minions over the event bus (Push & Events: Ansible and Salt).
Masterfiles Policy Framework (MPF): the default policy CFEngine ships, which schedules an agent run every five minutes with a splay (Convergence: CFEngine to Puppet).
Minion: any system or device managed by Salt, usually running salt-minion (Push & Events: Ansible and Salt).
Module (Ansible): the code or binaries Ansible copies to and executes on each managed node for a task (Push & Events: Ansible and Salt).
Moved (Terraform): a moved block that rewrites a resource's state address before planning, so a rename doesn't destroy and recreate the object (Provisioning: Terraform, OpenTofu & the Alternatives).
No-code module: a private-registry module version marked No-code Ready, from which a user creates a workspace and starts its first run without writing Terraform (Governance, Guardrails & the Resource Catalog).
Node object: the Chef server's record of a node: its run-list, environment, normal attributes and last Ohai data (Chef).
Noop: Puppet's mode that partially simulates a run, reporting what each resource would change without touching anything (Convergence: CFEngine to Puppet).
Ohai: Chef's system profiler, which supplies node data such as platform, kernel, network, memory and cloud metadata at the start of a run (Chef).
Open Policy Agent (OPA): a CNCF policy engine that evaluates Rego policies against JSON input, such as a Terraform plan (Testing, Policy, Secrets & IaC Platforms).
OpenBao: the community fork of the last MPL-licensed Vault: a secrets manager with encrypted key-value storage, dynamic secrets, encryption as a service, leases and revocation (Testing, Policy, Secrets & IaC Platforms).
OpenTofu: the MPL-2.0 fork of Terraform under the CNCF, with the same backends and client-side state encryption (Provisioning: Terraform, OpenTofu & the Alternatives).
OpenVox: a community soft fork of Puppet by Vox Pupuli, with the same model under Apache 2.0 (Convergence: CFEngine to Puppet).
Organization Policy (Google Cloud): constraints on what configurations are allowed, managed or custom in CEL, in active or dry-run mode, inherited down the hierarchy and not retroactive (Governance, Guardrails & the Resource Catalog).
Owner (team reference): ownership recorded as a reference to a team that exists, assigned at vending and inherited down, with owner tags generated from it rather than typed (Governance, Guardrails & the Resource Catalog).
Packer: HashiCorp's tool for building machine images from a template across platforms, whose core is under the BSL and whose plugins are MPL (Baking Images: Packer).
Partner provider: a Terraform provider written and maintained by the company whose API it wraps, in the partner's own registry namespace (Provisioning: Terraform, OpenTofu & the Alternatives).
Pillar: Salt data compiled on the master and mapped to minions by a top file, readable only by the minion it is targeted to (Push & Events: Ansible and Salt).
Plan (Terraform): the graph walk with every provider asked what it would do, listing each resource change with its address and actions for review before apply (Provisioning: Terraform, OpenTofu & the Alternatives).
Platform and workload landing zones: Azure's split: one platform landing zone per Entra tenant for governance, security and shared networking, and one workload landing zone per workload (Governance, Guardrails & the Resource Catalog).
Platforms (Test Kitchen): the operating systems a Test Kitchen suite is tested on (Chef).
Playbook: an Ansible YAML file of plays, each mapping a set of hosts to an ordered list of tasks (Push & Events: Ansible and Salt).
Plays: the units of an Ansible playbook, each mapping a set of hosts to an ordered list of tasks (Push & Events: Ansible and Salt).
Policy group: a set of Chef nodes that share the same run-list and cookbooks, to which a Policyfile lock is pushed (Chef).
Policy set: a collection of policies HCP Terraform checks against every run's plan, scoped to the organization, projects, workspaces, Stacks or tagged workspaces (Governance, Guardrails & the Resource Catalog).
Policyfile.lock.json: the Policyfile lock recording every cookbook's version, content identifier and source, the attributes, and the policy's revision_id (Chef).
Policyfiles: Chef's answer to roles, environments and Berkshelf: a policy resolved into a lock and promoted unchanged from policy group to policy group (Chef).
Post-processor: a Packer step that runs on the result after the build and provisioners: compress, checksum, import or record it (Baking Images: Packer).
Precedence (Chef attributes): how Chef resolves a key set by several sources: six types and fifteen levels applied from lowest to highest, with the last one winning (Chef).
Preventive control: a guardrail that refuses the action at request time, such as an SCP or RCP, and needs nothing stored (Governance, Guardrails & the Resource Catalog).
Proactive control: a guardrail that checks a resource before it is provisioned and refuses it, such as a CloudFormation hook (Governance, Guardrails & the Resource Catalog).
Profile (InSpec): a reusable, versioned artifact that organizes multiple InSpec controls, with dependencies (Chef).
Progress: the company that acquired Chef Software and now owns Chef's products (Chef).
Promise: CFEngine's basic statement, made by a promiser (the object it affects) optionally to promisees (the stakeholders) (Convergence: CFEngine to Puppet).
Promisees: the stakeholders a CFEngine promise is made to (Convergence: CFEngine to Puppet).
Promiser: the object a CFEngine promise affects, such as a file or a port (Convergence: CFEngine to Puppet).
Provisioner (Packer): software that installs and configures the running machine before Packer captures it as an image (Baking Images: Packer).
Provisioner (Test Kitchen): the component that applies configuration to a Test Kitchen machine, such as the Chef provisioner resolving cookbooks with Policyfiles or Berkshelf (Chef).
Proxy minion: a Salt minion process that manages a device unable to run a minion itself (Push & Events: Ansible and Salt).
Pull agent and run interval: a daemon on each machine that fetches its desired state and applies it on a timer, so drift is corrected automatically every interval (Convergence: CFEngine to Puppet).
Pulumi: infrastructure as code in general-purpose languages, with state in Pulumi Cloud by default or in a customer-chosen backend, and secrets in state encrypted per stack (Provisioning: Terraform, OpenTofu & the Alternatives).
Pulumi Cloud: Pulumi's hosted state, deployments and secrets (ESC), billed in credits drawn by resource-hours (Testing, Policy, Secrets & IaC Platforms).
Puppet: pull-based configuration management in which the agent sends facts, the server compiles a catalog and the agent applies it on an interval (Convergence: CFEngine to Puppet).
Puppet Forge: the public site where Puppet modules are shared and installed from (Convergence: CFEngine to Puppet).
PuppetDB: the store of the latest facts, catalog and optionally reports for every Puppet node, which also enables exported resources (Convergence: CFEngine to Puppet).
Puppetfile: the file that pins Puppet modules for sites deploying code with r10k or Code Manager (Convergence: CFEngine to Puppet).
Reactor: the Salt master component that maps event tags to reactor SLS files, so an event can trigger a function on minions or the master (Push & Events: Ansible and Salt).
Refresh (Puppet): a resource reacting when a resource it subscribes to or is notify'd by changes, the classic case being a service restarting when its config file changes (Convergence: CFEngine to Puppet).
Refresh (Terraform): a plan asking each provider to read the real object and compare it with the cached attributes in state (Provisioning: Terraform, OpenTofu & the Alternatives).
Remediation task: Azure Policy's job that applies modify or deployIfNotExists to existing resources, running as the assignment's managed identity (Governance, Guardrails & the Resource Catalog).
Removed (Terraform): a removed block that drops an object from state while leaving it running, the declarative way to stop managing something (Provisioning: Terraform, OpenTofu & the Alternatives).
Report (convergence): what a run did per resource (previous and new values, success or failure, timing), the evidence of convergence (Convergence: CFEngine to Puppet).
Required tags: AWS tag policy keys marked mandatory for resource creation (report_required_tag_for, November 20, 2025), enforced in CloudFormation by a managed hook in warn or fail mode (Governance, Guardrails & the Resource Catalog).
Resource Abstraction Layer (RAL): Puppet's split of each resource into a type that names it and its properties, and providers that implement it for one platform (Convergence: CFEngine to Puppet).
Resource address: the key of each object in Terraform state (module path, mode, type, name and index), which moved blocks rewrite (Provisioning: Terraform, OpenTofu & the Alternatives).
Resource catalog: the list of what exists, who owns it and how fresh that knowledge is, joined from IaC state, the cloud inventory and the software catalog; its most useful output is where they disagree (Governance, Guardrails & the Resource Catalog).
Resource control policy (RCP): an AWS Organizations policy, since November 13, 2024, that sets the maximum permissions on resources even for principals outside the organization and grants nothing (Governance, Guardrails & the Resource Catalog).
Resource Explorer: AWS's organization-wide search for resources by name, tag and ID, eventually consistent and free (Governance, Guardrails & the Resource Catalog).
Restricted channel: an HCP Packer channel hidden from viewers, so a version can be tested in a channel such as candidate before promotion (Baking Images: Packer).
Revision ID (revision_id): the identifier of a Chef Policyfile lock, so a node's configuration is an artifact with an id that can be promoted and rolled back (Chef).
Revocation (images): marking an image version unusable, immediately or on a schedule, so no new builds or launches use it, cascading to descendants (Baking Images: Packer).
Role (Ansible): a limited distribution of reusable Ansible content (tasks, handlers, variables, templates, files) imported into a play (Push & Events: Ansible and Salt).
Role (Chef): a job function, with a run-list plus default and override attributes; a node can have several (Chef).
Roster: the Salt SSH file listing target machines, /etc/salt/roster by default (Push & Events: Ansible and Salt).
Rulebook: the unit of Event-driven Ansible, a set of rulesets each with event sources and rules (Push & Events: Ansible and Salt).
Rules (Event-driven Ansible): the parts of a ruleset whose conditions are evaluated against incoming events and which run an action on a match (Push & Events: Ansible and Salt).
Rulesets: groups within an Event-driven Ansible rulebook, each with one or more event sources and rules (Push & Events: Ansible and Salt).
Run tasks: HCP Terraform's integration point that calls an external service at pre-plan, post-plan, pre-apply or post-apply and takes its pass or fail (Testing, Policy, Secrets & IaC Platforms).
Run-list: the ordered list of recipes, named cookbook::recipe, that a Chef node converges (Chef).
Salt: configuration management with a master and minions on an event bus, and agentless operation over SSH (Push & Events: Ansible and Salt).
Salt SSH: running Salt commands and states over SSH without installing a minion, by copying a thin Salt tarball to the target; substantially slower than minions (Push & Events: Ansible and Salt).
SCARLETEEL: an attack in which credentials taken from a cluster node's metadata service read a terraform.tfstate holding a clear-text access key for a second account, the case for keeping state locked down and secret-free (Testing, Policy, Secrets & IaC Platforms).
Scripts against a panel API: imperative calls to a hosting panel's API (such as cPanel's WHM API), with no plan, no state, no graph and invisible drift (Provisioning: Terraform, OpenTofu & the Alternatives).
Sentinel: HashiCorp's policy language in HCP Terraform and Terraform Enterprise, with advisory, soft mandatory and hard mandatory enforcement levels (Testing, Policy, Secrets & IaC Platforms).
Service catalog: a list of what may be created, such as AWS Service Catalog portfolios of CloudFormation or Terraform products, or HCP Terraform no-code modules (Governance, Guardrails & the Resource Catalog).
Service control policy (SCP): an AWS Organizations policy that limits what principals in member accounts can do, with a deny at any level of the tree winning (Governance, Guardrails & the Resource Catalog).
Skills (Chef 360): agents that act on a node in Chef 360, some packaged as Habitat packages (Chef).
Soft mandatory: a Sentinel enforcement level that must pass unless an authorized operator overrides it, which records who overrode a failed policy (Testing, Policy, Secrets & IaC Platforms).
Software catalog: a list of what runs and who owns it, with relations such as ownedBy and dependsOn connecting services to their resources and teams (Governance, Guardrails & the Resource Catalog).
SOPS: a tool that encrypts values inside YAML, JSON, ENV, INI and binary files with a KMS, age or PGP, so an encrypted file can live in the repository (Testing, Policy, Secrets & IaC Platforms).
Spacelift: a hosted orchestration platform for OpenTofu, Terraform, Terragrunt, Pulumi and Kubernetes, with private workers in the customer's own cloud (Testing, Policy, Secrets & IaC Platforms).
Splay: a per-host delay added to a pull agent's run so a fleet doesn't hit the server in the same second (Convergence: CFEngine to Puppet).
Stacks: an HCP Terraform layer above workspaces that declares several components and their deployments across environments or regions in one configuration (Provisioning: Terraform, OpenTofu & the Alternatives).
State encryption: OpenTofu's client-side encryption of state and plan files before they reach any backend, its clearest divergence from Terraform (Provisioning: Terraform, OpenTofu & the Alternatives).
States (Salt): Salt's desired state, written in SLS files (YAML with Jinja) with requisites such as require and watch (Push & Events: Ansible and Salt).
Static checks: credential-free checks against configuration (validate, formatting, policy scanners) that cost nothing to run (Testing, Policy, Secrets & IaC Platforms).
Steampipe: an AGPL-3.0 CLI that exposes 150+ APIs as Postgres foreign tables queried live, with Powerpipe adding open controls (Governance, Guardrails & the Resource Catalog).
Suites (Test Kitchen): run-lists with attributes that Test Kitchen converges and verifies on each platform (Chef).
Supermarket: Chef's cookbook registry, public or run privately by a company (Chef).
Supervisor (Habitat): Habitat's runtime with deployment coordination and service discovery built in, under which Habitat packages run (Chef).
Tag policy: an AWS Organizations policy that standardizes tag keys, case and allowed values; untagged resources aren't evaluated by it (Governance, Guardrails & the Resource Catalog).
Tag (Salt event): the string each event on the Salt event bus carries for filtering, alongside a dictionary of data (Push & Events: Ansible and Salt).
Tags versus labels (Google Cloud): labels are per-resource metadata usable to filter billing; tags are separate, inherited resources usable in IAM and Organization Policy conditions (Governance, Guardrails & the Resource Catalog).
Tasks (Ansible): the ordered steps of a play, each calling a module (Push & Events: Ansible and Salt).
Template (Packer): a Packer configuration, in HCL2 or legacy JSON (Baking Images: Packer).
Terraform: HashiCorp's provisioning tool: HCL configuration, providers over gRPC, customer-held state, and plan then apply, with the largest provider and module ecosystem (Provisioning: Terraform, OpenTofu & the Alternatives).
Terraform policy (tfpolicy): HashiCorp's HCL policy framework, generally available July 16, 2026, that checks actual infrastructure state as well as planned changes (Governance, Guardrails & the Resource Catalog).
Test Kitchen: a test harness that runs infrastructure code on one or more platforms in isolation, configured by a driver, provisioner, platforms, verifier and suites (Chef).
tfsec: a Terraform security scanner now folded into Trivy, which carries the same scanning engine (Testing, Policy, Secrets & IaC Platforms).
Top file: Salt's top.sls, which maps groups of machines to the states they get, per environment (Push & Events: Ansible and Salt).
The transaction (Puppet): the agent converting a catalog into a dependency graph, sorting it and converging each resource; it isn't atomic, so a failure halfway leaves earlier changes (Convergence: CFEngine to Puppet).
Trivy: Aqua's scanner, which absorbed tfsec's Terraform scanning engine (Testing, Policy, Secrets & IaC Platforms).
Type (Puppet): the part of a Puppet resource that names it and its properties, implemented per platform by providers (Convergence: CFEngine to Puppet).
Unchanged: the run status for a convergence run that found every resource already correct (Convergence: CFEngine to Puppet).
Unified Mode: a Chef custom-resource mode that compiles and converges each action block in one pass, so resources run in the order written; the default from Chef Infra Client 18 (Chef).
Unit tests (IaC): tests against a plan or mocked providers that prove a module's logic without creating anything (Testing, Policy, Secrets & IaC Platforms).
Values in the state file: whatever a provider returns is stored in Terraform state and plan files in plain text, and sensitive only redacts it from output, so state must be treated as secret (Testing, Policy, Secrets & IaC Platforms).
Vault: HashiCorp's secrets manager, moved to the BSL with the rest of HashiCorp's products, each release converting to MPL 2.0 after four years (Testing, Policy, Secrets & IaC Platforms).
Verifier (Test Kitchen): the tool that checks a converged Test Kitchen machine, such as InSpec, Cinc Auditor or Serverspec (Chef).
Waiver versus mitigated: the two exception categories: non-compliance temporarily accepted, or the rule's intent met another way through a compensating control (Governance, Guardrails & the Resource Catalog).
Well-Architected review: a check of a workload against a provider's architecture framework, a conversation about decisions rather than an audit, and not a guardrail (Governance, Guardrails & the Resource Catalog).
Why-run mode: Chef's dry run, which runs Chef on a system without the providers modifying it (Chef).
Workspaces (Terraform CLI): several named states for one configuration in one backend, which the docs say are not appropriate for system decomposition (Provisioning: Terraform, OpenTofu & the Alternatives).