This article reviews Terraform state, its purpose, and best practices for managing it effectively.
In this lesson, we’ll review Terraform state, its purpose, and best practices for managing it. Terraform state is a JSON file that records your infrastructure’s current configuration and serves as a single source of truth for Terraform operations like plan and apply.When you create a resource for the first time by running the Terraform apply command, Terraform generates a state file named terraform.tfstate in the same directory as your configuration files. Additionally, a backup file called terraform.tfstate.backup is created.
Terraform generates the state file, which contains all the details about the resources it created. For example, a snippet from the state file may look like this:
This state file holds vital information such as resource IDs, provider details, and all resource attributes that Terraform uses to manage your infrastructure.
Before generating an execution plan, Terraform refreshes the state by comparing it with the actual state of your external resources. For example, the output of the plan command may look like:
Copy
Ask AI
$ terraform planRefreshing Terraform state in-memory prior to plan...The refreshed state will be used to calculate this plan, but will not be persisted to local or remote state storage.aws_instance.cerberus: Refreshing state... [id=i-1db6bfe81bd1e3ed7]---------------------------------------------------------------------------No changes. Infrastructure is up-to-date.
If no differences are detected between your configuration and the real-world resources, Terraform indicates that no changes are needed. The apply command also performs a state refresh before proceeding with any updates.In certain cases, you might want to skip refreshing the state. This can be done using the -refresh=false option:
Disabling the state refresh is generally not recommended as it may introduce inconsistencies if resources have been manually modified. Use this option with caution, especially in large environments.
Tracking Configuration Changes with the State File
Terraform continuously monitors the state file to detect changes between your configurations and your provisioned resources. For example, if you change the instance type from m5.large to t3.micro, Terraform will detect the discrepancy during the next plan or apply.
During provisioning, Terraform creates the DB instance first, followed by the web instance. Conversely, when destroying resources, Terraform will remove the web instance before deleting the DB instance.
The state file contains sensitive information, including configuration variables and resource attributes like SSH keys or initial passwords. Store your state file securely in remote backends (e.g., Amazon S3 or Terraform Cloud) and never commit it to version control systems.
For illustration, here is a snippet showing sensitive data in a state file:
Terraform state is designed exclusively for internal Terraform operations. It is essential to avoid manually editing the state file and to use Terraform commands to manage state. The information contained in the state file is crucial, and any changes to the configuration are reflected through Terraform’s plan and apply process.For example, here is a state file entry for a development EC2 instance:
Remember, proper management of your Terraform state is key to maintaining the integrity and security of your infrastructure. For more detailed information and advanced state management practices, refer to the Terraform documentation.
Tracks infrastructure, resources, and metadata in a JSON format
terraform.tfstate, terraform.tfstate.backup
Refreshing Terraform State
Ensures state matches external resources before planning and applying
terraform plan, terraform apply
Resource Dependencies
Records dependencies to manage correct resource creation and deletion
depends_on attribute in resource configuration
Secure State Management
Store state in secure remote backends and avoid version control exposure
Using backends like Amazon S3 or Terraform Cloud
By following these best practices, you can ensure that your Terraform operations are secure, reliable, and accurately reflect your intended infrastructure changes.
