Terraform remote state and state locking is important part in team collaboration. What are challenges when working on Terraform in a team:
1. how to synchronize terraform state between people
2. how to avoid collisions of running terraform at the same time
Terraform remote state
Terraform remote state is a mechanism to share state file by hosting it on a shared resource like aws s3 bucket or consul server.
Example of storing state in s3 bucket.
terraform {
backend "s3" {
bucket = "mybucket-terraform-state-file"
key = "example/terraform.tfstate"
region = "us-east-1"
encrypt = true
}
}
Bucket have to be created beforehand. You the key to separate states from difference modules and projects.
Terraform state locking
Terraform locking state isolate state changes. As soon as lock is acquired by terraform plan or apply no other terraform plan/apply command will succeed until lock is released.
To store lock in dynamodb table you need:
– Create dynamodb table in your aws account in the same region as specified in your terramform backend configuration (us-east-1 in our case)
– primary key must have a name LockID without it locking will not work
terraform {
backend "s3" {
bucket = "mybucket-terraform-state-file"
key = "example/terraform.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "terraform_example_lock"
}
}
Note that terraform provide a way to disable locking from command line using -lock=false flag, but it is not recommended.
One improvement is to set “key” keyword as variable and base it on module or project, so you don’t have to set it manually. One caveat with that approach is to make sure they key is unique across projects.
Best,
Iaroslav