Skip to main content
Welcome to this module on Terraform state fundamentals. So far you’ve focused on writing clean, reusable Terraform code. In this lesson we’ll examine what powers Terraform behind the scenes: the state file. Understanding state helps you manage infrastructure reliably, collaborate safely, and troubleshoot unexpected changes. This lesson covers four core areas:
  • What Terraform state is and why it matters.
  • How Terraform uses state to track resources, detect differences, and produce accurate execution plans.
  • Security considerations for storing and sharing state.
  • How Terraform refreshes state, detects drift, and how refreshed state affects planning and execution.
Terraform state is more than simple metadata. It is Terraform’s authoritative record for what exists in your environment. By persisting resource IDs, attributes, dependency relationships, and provider-specific details, state enables Terraform to:
  • Map resources in your configuration to real-world objects.
  • Compute diffs between the desired configuration and current reality.
  • Generate a precise execution plan that performs only the necessary changes.
State is the authoritative record Terraform relies on to know which resources exist and how they relate. Losing or corrupting state can prevent Terraform from managing infrastructure correctly.

​
Quick summary table

​
How Terraform uses state

Terraform keeps a serialized snapshot of the infrastructure it manages. That snapshot contains:
  • Resource IDs and attributes needed by providers to reference cloud objects.
  • Metadata for dependency graph resolution.
  • Provider-specific information (for example, auto-generated names, ARNs, subresource IDs).
At plan time, Terraform compares the desired configuration to the state file (and the provider’s live API during refresh when necessary) to compute a set of operations: create, update, or delete. Because state contains identity and attribute values, Terraform can:
  • Determine whether a resource already exists or must be created.
  • Compute minimal updates instead of recreating resources unnecessarily.
  • Maintain stable resource addresses across runs.

​
Security considerations

State files often contain sensitive information such as resource identifiers, network details, and sometimes secrets or tokens. Treat state with the same care you apply to other secrets:
  • Never commit state files to source control.
  • Use remote backends (for example, S3 with DynamoDB locking, Azure Blob Storage, or Terraform Cloud/Enterprise) for team collaboration.
  • Enable server-side encryption and backend-level access controls.
  • Use state locking where supported to prevent concurrent modifications.
Terraform state can contain secrets and credentials. Never commit state files to source control. Use remote backends with encryption and access controls for team or production use.

​
Backends and collaboration (local vs remote)

Choosing the right backend affects collaboration, performance, and safety. Use remote backends for team or production workflows. Recommended reading:
  • Terraform State (Terraform docs)
  • Backend-specific docs (AWS S3, Google Cloud Storage, Azure Blob, Terraform Cloud)

​
Refresh, drift detection, and effects on planning

Terraform can refresh state by querying provider APIs to update the stored attributes before planning. Refresh behavior is central to understanding why plans change:
  • Refresh updates state attributes to reflect the current live environment.
  • If resources changed outside Terraform (drift), a refresh will reveal differences and update state accordingly.
  • After refresh, Terraform re-evaluates diffs and may generate a different plan (for example, to reconcile drift or to make further intended changes).
Common workflow implications:
  • Run terraform plan frequently in CI to detect drift early.
  • Use terraform refresh or terraform plan -refresh=true when you suspect out-of-band changes.
  • Review plan outputs carefully after refresh—some differences may require manual reconciliation or import.

​
Best practices

  • Use remote backends with locking and encryption for teams.
  • Protect access to state storage with fine-grained IAM policies.
  • Never store secrets in plain text within state; use secrets management integrations when possible.
  • Regularly run plans in CI to detect drift.
  • Use terraform import to bring unmanaged resources under Terraform control rather than editing state manually.
  • Version your Terraform configurations and maintain a clear drift remediation policy.
This module gives you the conceptual foundation to manage Terraform state safely and predictably. Use the guidance above to design backends, secure state, and manage drift across environments.

Watch Video