Terraform state - the file that can take down your infra

The terraform.tfstate is the map between your code and the real world. Lose the state, lose control of your infrastructure.

What the state stores

Every resource created, its real IDs in the cloud, dependencies, and metadata. This is how Terraform knows what needs to be created, changed, or destroyed in a plan.

Why local state is dangerous

• No teamwork: everyone with a different state
• No locking: two simultaneous apply operations corrupt everything
• Secrets can be stored in plain text in the file

Remote Backend with S3

terraform {
  backend "s3" {
    bucket       = "meu-terraform-state"
    key          = "prod/network.tfstate"
    region       = "us-east-1"
    encrypt      = true
    use_lockfile = true
  }
}

After configuring:

terraform init -migrate-state
terraform plan

Golden rules

1. State always remote, versioned, and encrypted
2. Never edit the state manually — use terraform state mv and similar commands
3. One state per environment (dev/staging/prod separated)

References

• HashiCorp Developer — Terraform state — documents the purpose and functioning of the state.
• HashiCorp Developer — Backend S3 — official reference for remote storage and locking in S3.
• HashiCorp Developer — State Management — presents the safe commands for manipulating resources in the state.
• LINUXtips — Essentials Training — Terraform Essentials page, the course used as the basis for my studies and these notes.