Terraform

State is the single source of truth for what Terraform thinks exists — treat every decision below as protecting that file, because a corrupted or concurrently-written state file is how infra drifts silently or gets destroyed by accident.

Remote state and locking

The local backend supports filesystem locking, but does not provide shared state for a team. Use a supported remote backend for shared environments and confirm that its locking is enabled:

• S3 — use_lockfile = true in the backend block (native S3 conditional-write locking); the older DynamoDB-table lock is deprecated but still works on existing setups.
• GCS — locking is built into the backend via object generation, nothing extra to configure.
• Terraform Cloud/Enterprise — locking is automatic per workspace.

These details describe Terraform backends; check the installed Terraform/OpenTofu version before copying backend options.

Locking exists to stop two apply runs from writing the same state concurrently and corrupting it — never disable it to "unblock" a run; find out why the lock is stuck (terraform force-unlock only after confirming no other run is actually in flight).

State is sensitive: it can contain plaintext secrets (DB passwords, API keys) pulled from resource attributes. Restrict backend bucket/table access the same way you'd restrict a secrets store — least-privilege IAM, encryption at rest, never fetched into a log or CI artifact, never committed to version control.

Module layout