A friend describes Terraform state as the database nobody backs up. I think about that every time I see a local state file in a repo.
The baseline I now refuse to work without:
- Remote state with locking. S3 + DynamoDB is boring and correct.
- One state per environment, never a shared state with workspaces pretending.
- An import path that doesn't require editing state by hand.
- Drift detection on a schedule, not when someone notices.
The failure I've seen twice: someone imports a resource into the wrong state, and the next apply tries to recreate production. Locking doesn't help if the lock is on the wrong file.
The other thing: state contains secrets in plaintext. If the bucket isn't encrypted and access-controlled, you have a leak.
It's not glamorous, but the state is the system. Treat it like a database: back it up, lock it, review changes to it.
What's your drift detection setup?
Top comments (0)