Terraform State: The Map to Your Infrastructure
Terraform state is the source of truth mapping your code to real cloud resources. It's used on every plan and apply to determine changes. The footgun: never store state in Git or edit the tfstate file directly; this risks corruption and secret leaks.
Why it exists
Terraform needs a way to track the resources it is supposed to manage. Without a record, it wouldn't know if a resource in your code corresponds to an existing one in the cloud or if it needs to create a new one. State provides this crucial link between your intent and the real world.
The mental model
Think of Terraform state as a detailed map and inventory list for your infrastructure. Your configuration files are the blueprint of what you want, but the state file is the record of what has actually been built and its unique ID in the cloud. Terraform consults this map before every operation to plan its route.
How it works
Terraform stores a JSON file, terraform.tfstate, that contains a one-to-one mapping between resource instances in your configuration and the remote objects in your cloud provider. When you run terraform apply, Terraform creates the infrastructure and records the resulting cloud object IDs in the state file. Before the next run, it performs a refresh, comparing the state file to the live infrastructure to detect any drift.
When to use it
State is not optional; it's fundamental to how Terraform works. For any team project, you must configure a remote backend, such as an S3 bucket, Azure Blob Storage, or HCP Terraform. This enables collaboration by providing a central, shared state and, crucially, state locking to prevent multiple people from running apply at the same time and corrupting the state.
When not to use it
You should never manage state manually. Do not edit the terraform.tfstate file by hand, as this can easily de-sync your configuration from reality. Also, never store the state file in a version control system like Git. It often contains sensitive data in plain text, and Git does not provide the locking mechanism necessary to prevent race conditions in a team environment.
One canonical example
By default, Terraform creates a terraform.tfstate file in your local directory. For a team, you would add a backend block to your configuration, like backend "s3" { bucket = "my-tf-state-bucket" key = "prod/network/terraform.tfstate" region = "us-east-1" }. This tells Terraform to store the state file in a specific S3 bucket, using its native locking features to ensure safety.
Interview question
Which of the following is a critical reason to avoid storing Terraform state files in a version control system like Git?
- a.State files can expose sensitive data and lack necessary locking for concurrent team operations.Correct
- b.Storing state in Git prevents Terraform from automatically refreshing the state before an apply.
- c.Git's diffing tools are incompatible with the JSON format of state files.
- d.Terraform state files are too large for efficient storage and retrieval in most Git repositories.
Why? this is the answer
The card explicitly states that state files often contain sensitive data in plain text and Git lacks the locking mechanism needed to prevent race conditions in a team environment. Option A directly addresses these two critical concerns. Other options describe less critical or incorrect reasons.
Just read this? Test yourself on what you have been reading.
Read the original → developer.hashicorp.com
- #terraform
- #iac
- #devops
- #state management
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles