Workspaces & environments

dev, staging, prod from one codebase.

You rarely manage just one environment. The two common patterns are the same as Terraform: workspaces, which keep multiple named states for one configuration, and directory-per-environment, which gives each environment its own directory and backend key. Workspaces are quick; separate directories are clearer and safer for very different or high-blast-radius environments like production.

$ tofu workspace new staging
$ tofu workspace new prod
$ tofu workspace select prod
$ tofu workspace list
  default
  staging
* prod
# reference the current workspace in config:
#   bucket = "acme-${terraform.workspace}-data"

Choosing a pattern

Workspaces share one backend and one configuration, so they suit environments that are structurally identical and differ only by variables. When environments diverge — different accounts, different sizing, production needing extra guardrails — a directory (or a Terragrunt layout) per environment keeps their state and settings fully separate, which is easier to reason about and harder to fat-finger across.