Infrastructure code must be safe to run twice
Non-idempotent infrastructure scripts are a defect category with no analogue in application code — practitioners surveyed rated it the most recognisable of eight categories — and they fail precisely when re-run during recovery.
Do this firstPin every dependency to an exact version
The property is that applying the same script twice leaves the system in the same state as applying it once.
It earns a page separate from determinism generally because of when it bites. Nobody runs provisioning twice on a good day. It gets re-run during recovery, after a partial failure, or when a retry fires — which means a non-idempotent script is a defect that only manifests while you are already in trouble.
The defect taxonomy behind this was built from 1,448 defect-fixing commits and quantified across 80,425, and its most frequent category overall was not idempotency but erroneous configuration data — worth knowing, because it means the most common infrastructure defect is a wrong value, not wrong logic.
The decoy
A change that succeeded. Running it once and getting the result you wanted says nothing about the second run, and the second run is what happens during every recovery, every retry and every re-provision.
Evidence
- Gang of Eight: A Defect Taxonomy for Infrastructure as Code Scripts — II partly self-reportedAn eight-category defect taxonomy including one with no application-code analogue — idempotency, "defects that lead to incorrect system provisioning when the same IaC script is executed multiple times" — which surveyed practitioners recognised most strongly. The most frequent category overall was erroneous configuration data, not wrong logic.
Last reviewed 2026-08-19.