Infrastructure as Code Quality Metrics: A Systematic Framework for Evaluating Terraform Configurations

Abstract

Infrastructure as Code (IaC) adoption has accelerated cloud provisioning but introduced new categories of configuration drift and security misconfigurations. This paper proposes a systematic quality metric framework for Terraform configurations, encompassing modularity, idempotency, security posture, and maintainability scores. We analysed 3,200 public Terraform repositories on GitHub and applied static analysis combined with runtime drift detection. Our framework identified critical security gaps in 41% of repositories and modularity deficits in 67%. A composite IaC Quality Index (IQI) is introduced and validated against real-world incident logs from three cloud providers, demonstrating strong correlation with post-deployment failure rates.