IaC state management

IaC state maps declarations to real resource identities. It often contains IDs, generated names, outputs, and sometimes secrets — store it remotely with locking, access control, backup, and audit trails.

| Risk | Mitigation | |------|------------| | Concurrent apply | Remote backend with locking | | Leaked state | RBAC, encryption, no public buckets | | Lost state | Backups and documented recovery | | Manual edits | Rare, reviewed, backed-up surgery |

					terraform {
  backend "s3" {
    bucket         = "org-tf-state"
    key            = "api/prod/terraform.tfstate"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}
				

On interviews: why losing state is dangerous, how concurrent applies corrupt state, and when import or state moves support refactors.

Common pitfalls: committing local state; sharing one state file across environments; editing state without backup.

The trade-off is operational flexibility (manual fixes) versus integrity of the infrastructure source of truth.

Checklist:

• Remote state with locking.
• Restrict access and encrypt at rest.
• Back up before state surgery.
• Treat state as sensitive operational data.