Localized slice
Terraform/OpenTofu: remote state, locking, and recovery
Why state is an operational contract, how locking prevents concurrent writers, and what evidence safe recovery requires.
State is not a disposable cache
State connects declarative addresses to real objects, stores metadata, and makes the next plan possible. Losing or blindly editing it can turn valid infrastructure into orphaned resources or dangerous recreation.
Remote backends and locking solve different problems
A backend centralizes and protects state; locking prevents two simultaneous writers. Encryption, versioning, least privilege, and recovery remain necessary even when the lock works.
- Lock per workspace or state unit, not by hope.
- Keep versions and rehearse restoration before an incident.
Recovery starts with evidence, not commands
Before force-unlock, import, or state surgery, identify the writer, preserve a copy, and compare the real provider with the last known plan. The goal is not fast unlocking; it is a verifiable relationship among configuration, state, and resources.
References
[1]
OpenTofu state documentationOfficial state semantics and its relationship to remote objects.
[2]
Terraform backend state lockingOfficial locking behavior and force-unlock conditions.