https://k-s-pavan-kumar.github.io/hugo-nimbus/tags/terraform/Recent content in Terraform on NimbusHugoen-usWed, 15 Feb 2023 10:00:00 -0700https://k-s-pavan-kumar.github.io/hugo-nimbus/blog/post-2/Wed, 15 Feb 2023 10:00:00 -0700https://k-s-pavan-kumar.github.io/hugo-nimbus/blog/post-2/<p>Local Terraform state works fine for a weekend project. It falls apart the moment a second engineer runs <code>terraform apply</code> against the same infrastructure. Here&rsquo;s the setup we settled on after a state file conflict took down a staging environment for an afternoon.</p> <div class="alert alert-warning"> <div class="flex items-start"> <div class="flex-shrink-0"> <svg class="h-5 w-5 mt-0.5" fill="none" viewBox="0 0 24 24" stroke="currentColor"> <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.082 15.5c-.77.833.192 2.5 1.732 2.5z" /> </svg> </div> <div class="ml-3 flex-1"> <h4 class="text-sm font-semibold mb-1">State files contain secrets</h4> <div class="text-sm"> Terraform state can include plaintext values for anything marked <code>sensitive</code> in your provider — database passwords, API keys, TLS private keys. Treat your state backend&rsquo;s access controls with the same care as a secrets manager, not like a build artifact. </div> </div> </div> </div> <h2 id="move-to-a-remote-backend">Move to a remote backend</h2> <p>A local <code>terraform.tfstate</code> file has no locking and no history. The fix is a remote backend with state locking built in:</p>