Terraform State Management: Remote Locking with S3 & DynamoDB

The Terraform State Risk

Terraform uses a state file (`terraform.tfstate`) to track managed infrastructure. If multiple developers deploy changes simultaneously without state locking, the file can become corrupted, leading to broken deployments and resource leaks.

Case Study: Split-State Production Outage

Two developers ran `terraform apply` concurrently on different machines. This resulted in duplicated network gateways and resources being deleted because the local state files got out of sync.

The Bug: Local State Management

The team stored the state file locally in their git repository (or didn’t configure state locking):

# Missing remote backend configuration
terraform {
  # Local state default
}

The Fix: Configuring S3 and DynamoDB Backends

We migrated the state to an encrypted AWS S3 bucket and configured a DynamoDB table to handle locks:

# Secure Backend Configuration
terraform {
  backend "s3" {
    bucket         = "codestackify-tf-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-lock-table"
  }
}

Now, whenever a deployment starts, Terraform locks the state using DynamoDB. Consequent deployment requests wait in line, preventing state conflicts.