Skip to main content
In this lesson, we’ll review Terraform state, its purpose, and best practices for managing it. Terraform state is a JSON file that records your infrastructure’s current configuration and serves as a single source of truth for Terraform operations like plan and apply. When you create a resource for the first time by running the Terraform apply command, Terraform generates a state file named terraform.tfstate in the same directory as your configuration files. Additionally, a backup file called terraform.tfstate.backup is created.

​
Initial Resource Creation

Consider the following Terraform configuration:
When you run the apply command:
Terraform generates the state file, which contains all the details about the resources it created. For example, a snippet from the state file may look like this:
This state file holds vital information such as resource IDs, provider details, and all resource attributes that Terraform uses to manage your infrastructure.

​
Refreshing State with Terraform Plan

Before generating an execution plan, Terraform refreshes the state by comparing it with the actual state of your external resources. For example, the output of the plan command may look like:
If no differences are detected between your configuration and the real-world resources, Terraform indicates that no changes are needed. The apply command also performs a state refresh before proceeding with any updates. In certain cases, you might want to skip refreshing the state. This can be done using the -refresh=false option:
Disabling the state refresh is generally not recommended as it may introduce inconsistencies if resources have been manually modified. Use this option with caution, especially in large environments.

​
Tracking Configuration Changes with the State File

Terraform continuously monitors the state file to detect changes between your configurations and your provisioned resources. For example, if you change the instance type from m5.large to t3.micro, Terraform will detect the discrepancy during the next plan or apply.

​
Original Variable Definitions

And a sample snippet from the terraform.tfstate file:

​
After Modifying the Configuration

Terraform’s execution plan will mark the resource for recreation due to the change in instance type.

​
Managing Resource Dependencies

Terraform also manages inter-resource dependencies using the state file. Consider a configuration where a web instance depends on a DB instance:
The state file captures this dependency explicitly:
During provisioning, Terraform creates the DB instance first, followed by the web instance. Conversely, when destroying resources, Terraform will remove the web instance before deleting the DB instance.

​
Security and Remote State Management

The state file contains sensitive information, including configuration variables and resource attributes like SSH keys or initial passwords. Store your state file securely in remote backends (e.g., Amazon S3 or Terraform Cloud) and never commit it to version control systems.
For illustration, here is a snippet showing sensitive data in a state file:
The configuration for managing dependencies remains the same:

​
Final Thoughts on Terraform State

Terraform state is designed exclusively for internal Terraform operations. It is essential to avoid manually editing the state file and to use Terraform commands to manage state. The information contained in the state file is crucial, and any changes to the configuration are reflected through Terraform’s plan and apply process. For example, here is a state file entry for a development EC2 instance:
Remember, proper management of your Terraform state is key to maintaining the integrity and security of your infrastructure. For more detailed information and advanced state management practices, refer to the Terraform documentation.

​
Summary

By following these best practices, you can ensure that your Terraform operations are secure, reliable, and accurately reflect your intended infrastructure changes.

Watch Video