0Pricing
DevOps Bootcamp · Lesson

Managing Terraform State and Remote Backends

Understand Terraform state, configure secure remote backends, handle state locking, and avoid state corruption in collaborative IaC pipelines.

Managing Terraform State and Remote Backends is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Terraform State

Terraform records what it has created in a state file (terraform.tfstate). It maps your configuration to real cloud resources.

Without state, Terraform would not know which resources already exist and could create duplicates or fail to update.

Why Local State Fails Teams

By default, state lives on your local disk. That breaks down with a team or in CI:

  • Others cannot see your state
  • Concurrent runs corrupt the file
  • The file holds secrets in plain text and could be committed by accident

The fix is a remote backend.

Remote Backends

A remote backend stores state in a shared, durable location such as an S3 bucket, Azure Blob, GCS, or Terraform Cloud.

This gives every pipeline run a single source of truth for the current infrastructure.

terraform {
  backend "s3" {
    bucket = "my-tf-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}

State Locking

If two pipeline runs apply at the same time, they can corrupt state. State locking prevents this by allowing only one write at a time.

With the S3 backend, a DynamoDB table provides the lock. Terraform Cloud locks automatically.

  backend "s3" {
    bucket         = "my-tf-state"
    key            = "prod/terraform.tfstate"
    dynamodb_table = "tf-locks"
  }

Encrypting State

State files often contain sensitive values like passwords and keys. Always encrypt state at rest.

For the S3 backend, enable bucket encryption and set encrypt = true in the backend config.

  backend "s3" {
    bucket  = "my-tf-state"
    key     = "prod/terraform.tfstate"
    encrypt = true
  }

Workspaces for Environments

Terraform workspaces let one configuration manage multiple state files, one per environment.

Switch between them so staging and production never share the same state.

terraform workspace new staging
terraform workspace select production

Plan and Apply in CI

In a pipeline, run terraform plan to preview changes (often on PRs) and terraform apply to make them (on merge to main).

Save the plan to a file so apply uses exactly what was reviewed.

terraform plan -out=tfplan
terraform apply -auto-approve tfplan

Inspecting State

You can query the state to see what Terraform is tracking.

  • terraform state list — list managed resources
  • terraform state show <addr> — details of one resource

Avoid editing state by hand; use commands instead.

terraform state list
terraform state show aws_instance.web

Importing Existing Resources

If a resource was created outside Terraform, bring it under management with terraform import instead of recreating it.

This avoids destructive duplication when adopting IaC on existing infrastructure.

terraform import aws_s3_bucket.logs my-existing-bucket

Handling Drift

Drift happens when someone changes infrastructure manually, so reality no longer matches state.

Run terraform plan regularly to detect drift, then either reapply to restore or update the config to match.

Never Commit State

Even with a remote backend, make sure local state and plan files are git-ignored. They contain secrets.

A good .gitignore protects you from accidental leaks.

# .gitignore
*.tfstate
*.tfstate.*
tfplan
.terraform/

Quick Check

Test your understanding of Terraform state.

Recap

You learned to manage Terraform state safely.

  • State maps config to real resources; never edit it by hand
  • Remote backends share state across the team and CI
  • Locking and encryption protect against corruption and leaks
  • Workspaces isolate environments; plan detects drift

Solid state management is the backbone of reliable IaC pipelines.

Frequently asked questions

Is the “Managing Terraform State and Remote Backends” lesson free?

Yes — the full text of “Managing Terraform State and Remote Backends” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Managing Terraform State and Remote Backends”?

Understand Terraform state, configure secure remote backends, handle state locking, and avoid state corruption in collaborative IaC pipelines. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Managing Terraform State and Remote Backends” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. IaC with Terraform and GitHub Actions
  2. Managing Cloud Resources
  3. Automating Infrastructure Updates
  4. Managing Terraform State and Remote Backends
← Back to DevOps Bootcamp