What is Terraform state, why is it needed, and where should it be stored?

Summary

State maps resources in your configuration to real objects (IDs, attributes), records dependencies and metadata, and lets Terraform compute plans quickly. For teams it must be stored remotely in a shared backend with locking (for example S3, Azure Blob Storage, Google Cloud Storage, or HCP Terraform), never committed to Git.

Longer Answer

Why remote: everyone and every pipeline must see the same state; locking stops two applies from running at once and corrupting it; and the backend can be versioned and encrypted. State often contains secrets (database passwords, generated keys) in plain text, so restrict access, encrypt at rest and enable versioning so you can recover from mistakes.

With the S3 backend, recent Terraform versions support native lock files in S3 (use_lockfile = true), replacing the older DynamoDB lock table.

Code Example

terraform {
  backend "s3" {
    bucket       = "acme-terraform-state"
    key          = "prod/network/terraform.tfstate"
    region       = "eu-west-1"
    encrypt      = true
    use_lockfile = true
  }
}

Key Points

• Maps config to real resource IDs.
• Remote backend with locking and versioning.
• State can contain secrets: protect it.
• Never commit state to Git.

What interviewers look for

Understanding of why state exists, locking, and that state is sensitive.

Follow-up questions

• What happens if two engineers apply at the same time without locking?
• How would you recover a corrupted state file?