Remote State Safety (locking, drift, and recovery)

Remote state makes Terraform collaboration possible—but it must be used safely.

Learning outcomes

After this tutorial you can:

• explain why locking matters
• reduce drift and unexpected changes
• recover safely using plan review

1) Locking and why it matters

If two runs update the same state concurrently, one run can overwrite the other.

Locking ensures:

• only one apply modifies state at a time
• other runs wait or fail fast

2) Plan review: the first safety gate

Always read terraform plan output:

• what resources will be created/changed/destroyed
• whether Terraform intends to replace resources

Save a plan (stronger safety)

terraform plan -out=tfplan
terraform apply tfplan

This ensures apply matches what you reviewed.

3) Drift: detecting changes done outside Terraform

Detecting drift

Run:

terraform plan

If you see changes but you didn’t update config, that suggests drift.

Fixing drift

Pick one:

• Update Terraform configuration to match desired state
• Or update/remove out-of-band changes (so it matches config)

4) State recovery concepts (high level)

When state and reality diverge, recovery may involve:

• importing resources into state
• using terraform state commands (advanced)
• ensuring the correct backend + correct environment key

Warning: state manipulation can be risky. Always back up state first and use careful review.

5) Environment isolation

Safety improves when each environment uses isolated state:

• dev and prod must not share state files

If you accidentally point to the wrong backend key, you can delete/modify production resources.

6) Prevent secrets leakage

State often contains sensitive values.

Recommendations:

• avoid outputting secrets
• mark outputs as sensitive = true
• use encryption on remote backend
• enforce access control (least privilege)

7) Operational checklist

• use remote state backend with locking
• separate state per environment
• review plan
• apply from saved plan in CI
• protect state storage and permissions
• avoid secrets in outputs