#State
9 posts
When Secrets End Up in tfstate in Plaintext: Rotation First, Then Prevention
Starting from the structural fact that tfstate stores values in plaintext regardless of sensitive markings: judging the exposure scope, why key rotation comes before any state cleanup, purging history when state was committed to git, and prevention — ephemeral resources and write-only arguments that keep values out of state, S3 backend encryption and access control, and designs where Terraform never touches the secret at all.
When terraform plan Is Slow: Refresh Load, Parallelism, and the Stack-Split Signal
Starting from the fact that plan time is dominated not by diff computation but by refresh, which reads the API for every resource: how resource count times API round trips sets the duration, the situations where -refresh=false is legitimate and where it is not, where raising parallelism collides with rate limits, why -target is not a performance tool, and the signals that say the real fix is splitting the stack.
When terraform plan Succeeds but apply Fails: Causes and Partial-Apply Recovery
Why a clean plan can still fail at apply: the asymmetry where plan validates only schema and references while real API validation happens at apply, the five typical causes (missing permissions, IAM propagation delays, service quotas, globally unique name collisions, parameter combinations), the safe recovery procedure for the partial-apply state that a non-transactional apply leaves behind, and when an already-exists error calls for import.
Recovering a Deleted terraform.tfstate: Backup File, S3 Versioning, and Re-import in Order
Starting with the symptoms of a missing state file and why you must not apply in that condition. We walk the recovery paths in priority order — checking the local terraform.tfstate.backup, the commands to restore a previous version from S3 versioning, and the last-resort path of rebuilding state with import when no backup exists — then cover the backend settings that structurally prevent the same accident.
How to Use terraform import: Bringing Existing Resources into Code with import Blocks
The procedure for bringing console-created resources under Terraform management, based on import blocks. Where to find each resource type's import ID, how to generate a code draft with -generate-config-out, how to adjust the code until plan shows no changes, the differences from the old CLI command approach, and the order to follow when importing multiple resources at once.
Fixing the terraform state lock Error: Finding the Cause and When to Use force-unlock
Starting with how to read the Lock Info block in the "Error acquiring the state lock" message. We cover the check procedure that separates the normal case — a teammate or CI is mid-run — from the abnormal one where a crashed run left a stale lock, the conditions under which force-unlock is safe and why misusing it corrupts state, plus where to look when the lock lives in DynamoDB and the settings that prevent recurrence.
Terraform Operations #2 Drift and State Surgery: Scheduled Detection, import Blocks, removed Blocks
Changes made outside the code need a detection system: a scheduled plan workflow with -detailed-exitcode catches drift within a day. We lay out the decision criteria for the three responses to drift — absorb into code, revert with apply, or hand over with ignore_changes. Then we adopt console-born resources with the import block, generate a code draft with -generate-config-out, and remove resources from state only — without destroying them — using the removed block.
Terraform Basics #9 Remote State and Collaboration: S3 Backend, Native Locking, and Protecting Sensitive Data
Walking through the three problems local state hits in team collaboration, then the S3 backend configuration and the migration flow init guides you through. We cover how use_lockfile native locking prevents concurrent runs and why the DynamoDB approach became legacy, plus versioning, encryption, and access control for the state bucket — wrapping up the basics series.
Terraform Basics #5 State Explained: The tfstate File Structure and How plan Computes Changes
Opening the terraform.tfstate file to examine its structure, and explaining how plan computes changes by comparing three things: code, state, and the real infrastructure. We also cover the problem of sensitive values stored in plaintext and the rule against committing state, manipulation commands like state list, show, mv, and rm, and what happens when you lose your state.