How to implement immutable cloud infrastructure deployment pipelines for secure microservices?

Treat the entire build‑to‑deploy flow as a reproducible, version‑controlled artifact that never changes once stored, and enforce it with declarative IaC, signed container images, and automated policy gates.

1. Define infrastructure as code (Terraform) and store in a dedicated Git repo with branch protection and signed commits (git‑verify‑signatures).
2. Build containers in an isolated CI runner (GitHub Actions) using a Dockerfile that ends with a FROM of a minimal, distroless base and runs docker build --pull --no-cache.
3. Sign the image with Cosign (cosign sign --key $COSIGN_KEY $IMAGE) and push to a private registry (e.g., ECR) with immutable tag policy.
4. Generate a SBOM with Syft (syft $IMAGE -o spdx-json) and store it as an artifact linked to the git commit.
5. Validate the SBOM and image against OPA policies (opa eval -i sbom.json -d policy.rego "data.policy.allow"). Fail the pipeline if any rule breaches.
6. Deploy via Terraform Cloud or Atlantis, referencing the exact image digest (image: $IMAGE@sha256:...). Terraform state lives in an encrypted S3 bucket with bucket‑level ACL private.
7. Enforce zero‑trust network: create a service‑mesh policy (Istio) that only allows inbound traffic from identities that match the signed image digest.

Tool          Purpose               Immutable support
Terraform     IaC                   state stored in versioned bucket
Cosign        Image signing         immutable tags enforced
OPA           Policy-as-code        deny mutable digests

Gotcha: Ensure the S3 bucket that holds Terraform state is not publicly readable; a misconfigured ACL lets an attacker replace the state file and roll back to a compromised image.