Explain Terraform state, why managing it is critical, and team best practices

WHAT THIS TESTS: Whether you understand that state is not just a cache but the source of truth for mapping configuration to real infrastructure. Interviewers want to see that you grasp the operational risks of state mismanagement in team settings, including concurrency hazards, secrets exposure, and drift.

A GOOD ANSWER COVERS: First, define state as the binding between resource instances in your configuration and actual remote objects, along with metadata and dependency graphs. Second, explain that Terraform uses state during plan and apply to determine what changes are needed, and that a refresh updates state against reality before operations. Third, emphasize remote state storage with locking, such as HCP Terraform, S3 with DynamoDB locking, or Terraform Cloud, to prevent concurrent modifications. Fourth, mention encryption at rest and in transit, strict access control, and versioning or backup strategies. Fifth, explicitly reject storing state in Git or other VCS because those systems lack locking and may expose secrets, since state files can contain plaintext credentials or sensitive resource attributes.

COMMON WRONG ANSWERS: Treating state as optional or purely a performance optimization. Recommending local terraform.tfstate files shared through Git, network drives, or email. Failing to mention state locking, which leads to race conditions and corrupted state when multiple team members run operations simultaneously. Ignoring the security implications of state files containing sensitive values. Suggesting manual editing of state JSON instead of using terraform state commands or import blocks.

LIKELY FOLLOW-UPS: How would you recover from a corrupted or lost state file? When would you use terraform state rm versus terraform import? How do you handle sensitive values in state? What is the blast radius of storing all environments in a single state file versus splitting by workspace or component? How do you manage state for disaster recovery or cross-region replication?

ONE CONCRETE EXAMPLE: A team of five engineers initially commits terraform.tfstate to Git. Two developers run apply simultaneously from different branches, causing one operation to overwrite the other's resource mappings and creating orphaned cloud resources. The fix is migrating to an S3 backend with DynamoDB locking, enabling versioning on the bucket, restricting IAM access to the state key, and adding state encryption. After migration, terraform plan and apply operations serialize safely, state history is preserved, and secrets are no longer in version control.

Source: developer.hashicorp.com