Terraform remote state and locking on S3 and DynamoDB

Move Terraform state off your laptop into an encrypted S3 or GCS backend with locking, so two applies never race and corrupt your infrastructure.

Terraform's default is a terraform.tfstate file on your laptop. It holds every resource id — often secrets in plaintext — and has no locking, so two people running apply at once can corrupt it. Remote state fixes all three problems at once.

Configure an S3 backend

terraform {
  backend "s3" {
    bucket         = "acme-tfstate"
    key            = "prod/network/terraform.tfstate"
    region         = "eu-west-1"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}

Locking with DynamoDB

The dynamodb_table gives you a distributed lock. When someone is applying, everyone else waits instead of racing.

aws dynamodb create-table \
  --table-name tf-locks \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

Migrate existing state

Related posts