What Is Terraform State and Why Does It Matter So Much?

State is what confuses Terraform beginners the most. Yet all of Terraform's logic rests on it: state is the ledger where Terraform remembers what it created in the real world.

What exactly is state?

When you run terraform apply, Terraform writes the ID and attributes of every resource it creates into a JSON file (terraform.tfstate). On the next plan/apply, it compares the 'desired state' in your code with the 'current state' in the file and computes the diff.

Without state, Terraform couldn't tell whether an AWS instance is one it manages or one someone else created. State is the bridge between your code and the real infrastructure.

Why is local state dangerous?

• Everyone on the team ends up with a different copy → conflicts and deleted resources.
• If the state file is lost, Terraform no longer 'recognizes' your infrastructure.
• Secrets can sit in plaintext inside state — unsafe on a laptop.

The fix: remote state + locking

In production, keep state in a remote backend (S3, GCS, Terraform Cloud). A lock prevents two people from running apply at once and corrupting state.

terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "prod/network.tfstate"
    region         = "eu-west-1"
    dynamodb_table = "terraform-locks"  # for locking
    encrypt        = true
  }
}

Managing state without breaking it

• Never hand-edit terraform.tfstate.
• Use 'terraform state mv' when renaming a resource.
• Use 'terraform import' to bring a hand-created resource under Terraform.
• Always keep state in a versioned, encrypted backend.

Incident: a 'state lock' conflict and drift

Two real incidents and their fixes. First: a colleague's apply died midway, and yours errors with 'state locked'.

$ terraform apply
Error: Error acquiring the state lock
  Lock Info: ID: 8f3c...  Who: ci@runner  Created: 2 min ago
# First confirm the OWNER (CI might still be running!). Once sure:
$ terraform force-unlock 8f3c...
Terraform state has been successfully unlocked!   # ✓ lock released

Drift: code and real infra diverged

1. 1terraform plan → unexpected changes? (someone edited via the console)
2. 2Read the plan output instead of refresh: where's the diff?
3. 3If the manual change is correct, update the code; if not, revert with apply
4. 4Adopt an unmanaged resource: terraform import

$ terraform plan
  ~ aws_security_group.web  ingress: [80] -> [80, 22]   # someone opened 22 by hand
# Decide: if 22 is unwanted, revert with apply; if wanted, declare it in code.
$ terraform import aws_s3_bucket.assets my-existing-bucket
Import successful!   # ✓ the hand-created bucket is now in state

Once you understand state, Terraform loses its mystery and becomes a powerful tool. In Cloudpuz's Terraform labs you apply these concepts on a real remote backend.