Terraform’s state maps your configuration to real resources and stores metadata needed to plan changes. Without it, Terraform can’t tell what already exists or what to update.

By default state is a local terraform.tfstate file — fine solo, unsafe for teams. A remote backend (S3, Azure Storage, GCS, Terraform Cloud) stores it centrally with locking so concurrent applies don’t corrupt it. State can hold secrets, so it must be encrypted and access-controlled — and never committed to git.

terraform {
  backend "s3" {
    bucket         = "my-tfstate"
    key            = "prod/terraform.tfstate"
    region         = "eu-west-1"
    dynamodb_table = "tf-locks"      # locking
    encrypt        = true
  }
}

terraform state list                 # what Terraform manages
terraform state show aws_s3_bucket.data
terraform import aws_s3_bucket.data my-existing-bucket

1. Explain what Terraform state is and why it’s necessary.
2. Describe two risks of keeping state local for a team.
3. Configure a remote backend with locking.
4. Use terraform import (in words) to bring an existing resource under management.

• ↗ Terraform — State