How do you manage Terraform state safely?

Direct answer

What a strong answer covers

How it works

State is the map between configuration and real resources, and it contains resource IDs and often secrets in plain text, so it is stored in a remote backend with encryption at rest, versioning for recovery, and locking so two applies cannot corrupt it. Access is limited to the CI identity and a few operators; environments use separate state files or workspaces so a mistake in staging cannot touch production. Changes flow through plans reviewed in pull requests and applied by automation, and manual state surgery with import, mv, or rm happens only through a documented procedure with a backup taken first.

Example

Each environment has its own S3 backend with versioning, KMS encryption, and a DynamoDB lock table; CI applies from a role that only that pipeline can assume, and engineers have read access for plans. When a resource was created by hand during an incident, it was brought under management with terraform import in a reviewed change rather than by editing the state file, and a state backup from before the import was kept for a week.

Common mistakes

• Committing terraform.tfstate to the repository with secrets inside.
• Sharing one state file across environments so a typo destroys production.
• Editing the state JSON by hand without a backup.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.