Pro · Lesson 5 of 12
State maps your config to real objects. A shared backend keeps one copy. Locking stops two applies from writing that copy at once. The lock mechanism depends on the backend and the version.
Sign in to save your place.
State is the notebook that says which locker number belongs to which name on the list. If two people write in the notebook at once, the numbers get crossed. A lock is the pencil you have to be holding to write.
By default the state file is terraform.tfstate in the working directory. That is fine for a solo lab. It is a bad place for a team. The file contains ids and any secret attributes the provider stored. Do not commit it.
Never edit the state file by hand to fix a typo. Use the commands and blocks in the lifecycle lesson. A hand edit is how the next plan destroys something real.
The S3 backend can store state in a bucket. Older Terraform releases locked that state with a DynamoDB table. Terraform 1.10 added an S3 lock file through use_lockfile. Current HashiCorp S3 backend docs describe DynamoDB locking as deprecated and scheduled for removal, and describe use_lockfile as the lock switch.
Those sentences are about HashiCorp Terraform's documented backend. An older binary does not grow use_lockfile because a doc page mentions it. OpenTofu has its own S3 locking work. Do not delete a DynamoDB lock table until every runner that touches that state is on a version that locks the way you think.
After a backend change, terraform init -reconfigure is the usual next command. Read the upgrade guide for the version you are moving to before you drop the old lock.
| Situation | What to do |
|---|---|
| One person, a lab, terraform_data | Local state is enough |
| A team on current Terraform S3 docs | Turn on use_lockfile and grant access to the .tflock object |
| Runners still on an older Terraform | Keep the lock mechanism those runners understand |
| OpenTofu in the same bucket | Read OpenTofu's backend page, not only HashiCorp's |
Step 1 of 3Config is what you want. It is not a record of what exists.
Step 2 of 3State records the ids. Lose it and the next plan looks like everything is new.
Step 3 of 3The lock stops a second apply. The lock's storage depends on version and backend.
From the previous lab directory, list the state file after a plan or apply. Add it to a local ignore file if you use git.
terraform plan
ls -la terraform.tfstate 2>/dev/null || echo "no state yet — plan may be enough"
printf '%s\n' '.terraform/' '*.tfstate' '*.tfstate.*' >> .gitignore
Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.