Immutable infrastructure

What it is

Immutable infrastructure is the practice of never modifying a running server or resource after it’s deployed. To change something, you replace it: build a new version from your IaC definition, deploy it alongside, and shift traffic to it — then tear the old one down. It’s the polar opposite of mutable servers that are patched, hot-fixed, and drifted over time.

Why it exists

Mutable servers accumulate configuration drift: each ad-hoc ssh fix and manual patch makes the machine different from its neighbors and from the code that created it — “works on my machine” at fleet scale. Immutable infrastructure guarantees the running environment is byte-identical to the validated definition, removing whole classes of “but it works in prod” bugs, making rollback trivial, and aligning perfectly with desired-state IaC.

Key ideas

• Build & replace, not patch: Az PowerShell/Bicep/Terraform create a new deployment; image-based (Packer/VM image, container images, or az vm image) provisioning bakes config in at build time.
• Pairing with deployment patterns: blue/green and canary / rolling deliver immutable units; health checks decide promotion.
• Self-healing: because deployments are identical, rolling, automatic rollback to the last-good artifact is clean ([[build-artifact]] is reproducible).
• Emphasis on config at build time: secrets and settings come from managed sources (Key Vault, App Configuration) so images stay generic and reusable.
• Drift-proof: nothing to drift — no in-place state, no snowflake servers. Any manual write is rejected or simply lost on replace.

How it fits (diagram)

Exam notes

• Know the contrast: mutable (patch in place, vulnerable to drift) vs immutable (replace, reproducible). AZ-400 favors immutable.
• Immutability + IaC = the cure for drift.
• Ties to VM scale sets, containerized workloads, and blue/green & canary strategies — replace the unit, never re-spin config.

Related

infrastructure-as-code · desired-state · configuration-drift · blue-green-deployment · canary-deployment · build-artifact

📘 Source: Microsoft Learn — Immutable Infrastructure