Production Rule
If more than one person or pipeline can run Terraform, local state is no longer acceptable. Move to a remote backend early.
State & Backends
Learn how Terraform remembers what it manages, why remote state is mandatory for teams, and how state problems create some of the most dangerous Terraform failures.
🧒 Simple Explanation (ELI5)
Terraform needs a memory file so it knows what it built. That memory is called state. Without it, Terraform would keep guessing. A backend is where that memory lives.
🤔 Why Do We Need It?
- Terraform must map code to real infrastructure objects.
- Teams need shared, consistent state rather than each engineer keeping a private local copy.
- Locking prevents multiple runs from corrupting state at the same time.
🔧 Technical Explanation
The state file stores resource metadata, relationships, and sometimes sensitive values. Backends define where state is stored. Local state is fine for learning. Shared environments should use remote state with locking and access control.
hcl
terraform {
backend "azurerm" {
resource_group_name = "rg-tf-state"
storage_account_name = "skillytfstate"
container_name = "tfstate"
key = "platform/dev.tfstate"
}
}| State Risk | Why It Matters |
|---|---|
| Local-only state | Team members see different realities |
| No locking | Concurrent applies can corrupt state |
| Sensitive content exposure | Secrets can leak through state storage |
| Manual edits | State drift and unsafe reconciliation |
Team-Safe State Pattern
Terraform Run
→
Azure Backend
Storage Account
Blob Container
State Lock
→
Shared Truth
🔒
🌍 Real-World Use Case
An Azure platform team stores Terraform state in a dedicated storage account with least-privilege access. Azure DevOps or GitHub Actions uses a service identity to read and update that state during plan and apply jobs. Every environment has a separate state key to avoid cross-environment collisions.
🛠️ Hands-on
Create a Backend Strategy
- Create a dedicated resource group and storage account for Terraform state.
- Use a naming scheme such as
platform/dev.tfstate,platform/stage.tfstate, andplatform/prod.tfstate. - Restrict write access so only approved automation can update state.
Useful Commands
bash
terraform state list terraform state show azurerm_resource_group.platform terraform force-unlock LOCK_ID
🐛 Debugging Scenarios
State Lock Error
If a previous run crashed, Terraform may report a lock still in place. Verify no other run is active before using terraform force-unlock.
Drift Between State and Reality
If someone changed infrastructure manually, plan may show unexpected updates or replacements. Compare the live platform, the state, and the code to decide whether to import, refresh, or correct the configuration.
⚠️
Danger
Never edit the state file casually. State surgery is possible, but it should be deliberate, backed up, and used only when you clearly understand the consequences.
📋 Interview Questions
Beginner
What is Terraform state?
It is the data Terraform keeps to track managed resources and map configuration to real infrastructure objects.
Why use a remote backend?
To share state safely across a team, enable locking, and centralize access and auditing.
What is state locking?
It prevents concurrent Terraform operations from modifying the same state at the same time.
Why is local state risky in teams?
Because each person may have a different copy, leading to conflicting views of the infrastructure.
Can state contain sensitive data?
Yes. That is why backend security and access control matter.
Intermediate
How would you structure state per environment?
Separate state files or keys per environment, with clear ownership boundaries and no accidental overlap between dev, stage, and prod.
Why is force-unlock dangerous?
Because unlocking while another valid run is active can lead to concurrent state modification and corruption.
What is a sign a Terraform state boundary is poorly designed?
If unrelated teams or systems keep affecting each other’s plans because too much infrastructure is packed into one shared state.
How does state relate to drift?
State represents Terraform’s recorded understanding, so drift appears when the live platform no longer matches that recorded view or the desired configuration.
Why separate the Terraform state storage account from application storage?
To isolate a critical control-plane dependency, apply stricter access controls, and reduce accidental interference.
Scenario-Based
A pipeline says the state is locked. What do you check first?
I first confirm whether another plan or apply is still running or recently failed, rather than unlocking immediately.
Two teams share one state file and keep breaking each other. What is the root issue?
The state boundary is wrong. Ownership and blast radius should be split into clearer stacks or modules with separate state.
Manual portal edits changed production. How do you recover safely?
Inspect the live resources, compare them with code and state, then decide whether to import, revert the manual change, or update the configuration to reflect intended reality.
Why does remote state matter for CI/CD integration?
Because automation needs a shared, authoritative state source that survives individual machines and supports consistent plans and applies.
What is your stance on storing tfstate in Git?
It is generally a bad idea because state changes frequently, may contain sensitive data, and lacks proper locking semantics.
🧾 Summary
State is Terraform’s memory, and backends determine how that memory is stored and shared. Understanding state is the difference between using Terraform casually and operating it safely in teams.