Terraform State Management, Locking, and Backups: A Production Deep Dive
Terraform State Management, Locking, and Backups: A Production Deep Dive Terraform state is an operational database, not a disposable artifact. This deep dive covers S3 backends, S3 and DynamoDB locking, encryption, IAM, backups, migrations, state surgery, CI concurrency, and incident runbooks. TL;DR Terraform state management should be treated like production data management: isolate state by blast radius, store it in a remote backend, enable locking, encrypt it, version it, and rehearse restore procedures before an outage. For AWS teams, the modern S3 backend can use native S3 lock files, while older estates may still need DynamoDB locking during migration. The strongest designs combine least-privilege IAM, S3 Versioning, KMS controls, CI concurrency, state migration discipline, and documented runbooks for stuck locks, accidental overwrites, and state surgery. Terraform State Is a Database, Not a File Use a remote backend, lock state, and back it up. The production version is mo...