ClickOps

ClickOps is the practice of managing cloud infrastructure by clicking through the provider's web console: creating instances, editing security groups, wiring up networks, and toggling settings by hand. It is the cloud-era equivalent of hand-configuring servers, and it produces the same irreproducible, undocumented mess at far greater scale.

The console is excellent for exploration and learning. As the system of record for production infrastructure, it is an anti-pattern.

Why It Happens

Consoles are immediate and discoverable. When you need a resource now, clicking is faster than writing and reviewing code. Teams new to the cloud, or under deadline pressure, default to the UI. Each console change feels harmless, but the cumulative effect is infrastructure whose true state exists only in the live account, with no version history and no review.

Why It Hurts

ClickOps leaves no audit trail of who changed what and why. Infrastructure cannot be reproduced in another region or account, so disaster recovery and environment parity are impossible. Changes are not peer-reviewed, so misconfigurations, especially security ones like an open security group, slip through. Accounts drift apart. When something breaks at 2 a.m., there is no diff to inspect and no rollback to apply.

Warning Signs

• Infrastructure changes are made primarily in the cloud console.
• There is no infrastructure-as-code repository, or it is badly out of date.
• Resources exist that no one can explain or attribute.
• Accounts and regions have drifted apart.

Better Alternatives

Manage infrastructure as code with Terraform, Pulumi, CloudFormation, or CDK, so every resource is defined, version-controlled, and peer-reviewed. Use GitOps to apply changes through pull requests. Enforce guardrails with policy-as-code (OPA, Sentinel) to block insecure configurations before they deploy. Reserve the console for read-only inspection and emergency break-glass access.

How to Refactor Out of It

Import existing resources into IaC using import tooling so the code reflects reality. Establish a rule that new resources must be created through code, and restrict console write access so it cannot be bypassed casually. Add drift detection to catch any out-of-band changes. Over time, bring legacy click-created resources under code management, prioritizing the highest-risk ones first.