Terraform’s state file maps your code to real resources. Lose it, and Terraform forgets what it manages. Leak it, and you may leak secrets. It deserves careful handling.
Never keep state on a laptop
Use a remote backend so the whole team shares one source of truth:
terraform {
backend "s3" {
bucket = "acme-terraform-state"
key = "prod/network.tfstate"
region = "eu-west-1"
encrypt = true
dynamodb_table = "terraform-locks"
}
}Lock it
State locking stops two people applying changes at the same time and corrupting the state. With the S3 backend, a DynamoDB table provides the lock.
Protect it
- Encrypt the bucket and restrict access to the pipeline and a few administrators.
- Enable versioning so a bad apply can be recovered.
- Keep it out of Git. State often contains secrets in plain text.
Split it
One giant state file makes every plan slow and every mistake large. Split state by environment and by component — network, data, applications — so changes stay small and contained.
