Step 01 of 06
Learn the concept
The state file is not a cache. It is Terraform's ledger of which real object belongs to which address in your configuration. Lose it and Terraform may forget what it owns; leak it and you may leak passwords in plain text.
The ideas this is made of
State maps names to real objects
Your code says aws_vpc.main. The cloud API returns an ID such as vpc-0f3a2c1b. State records that mapping plus the attributes Terraform last knew. Without it, Terraform cannot tell whether a matching object is already managed, merely similar, or unrelated. State is what lets a later plan update the same VPC instead of creating another one.
Local state is a single-player mode
A local terraform.tfstate file works while one person experiments. It fails when two people or two CI jobs can apply. They each have a different copy of the ledger, and whichever writes last wins. Remote backends put the ledger in one durable place. A lock adds the harder rule: only one apply can write at a time.
Concurrent apply is history corruption
Two applies starting together may both read the same old state, both decide changes are needed, and both call provider APIs. Even if the cloud rejects one call, the local state writers can still disagree about what happened. Locking prevents that class of accident. A lock error is not bureaucracy. It is Terraform refusing to let two operators edit the ledger at once.
Refresh shows drift without fixing it
terraform plan -refresh-only asks providers what exists now and proposes state updates without changing infrastructure. It is the right first move after suspected console changes. If somebody resized an instance by hand, a refresh-only plan can show the new observed value. You then decide whether to accept the drift into code or change the resource back.
Import adopts before it manages
terraform import connects an existing remote object to a Terraform address. It does not magically write perfect configuration. After import, you still add HCL that matches the object and run a plan until Terraform sees no unwanted change. Import is adoption paperwork, not a resource generator. Treat it slowly, especially for production networks.
terraform {
backend "local" {
path = "state/terraform.tfstate"
}
}
This is not collaboration-grade. It simply moves the local state file under a named path so the learner can inspect it and understand what remote backends later protect.
State storage choices
| Backend | Good for | Failure risk |
|---|---|---|
Local file | One-person learning | Lost file, no lock |
S3 plus DynamoDB | AWS teams | Misconfigured IAM |
Terraform Cloud | Hosted workflow | Org and token setup |
GCS bucket | GCP teams | Bucket policy mistakes |
What these are called on the job
Backend — The storage and locking system Terraform uses for state.
Lock — A guard that prevents concurrent state writes during plan or apply operations that can mutate state.
Refresh — A provider read that updates Terraform's view of real resources.
Import — Attaching an existing remote object to a Terraform address so Terraform can manage it.