What is Terraform State and Why Does It Matter?
Learn what Terraform state is, why it must be stored remotely with locking, and how it drives plan and apply — with a DevOps interview answer.
Expected Interview Answer
Terraform state is a JSON file (typically terraform.tfstate) that maps every resource block in your configuration to the real-world infrastructure object it created, letting Terraform know what already exists so it can compute an accurate diff on the next plan.
Without state, Terraform would have no way to know that the aws_instance.web block in your code already corresponds to i-0abc123 in AWS; it would either try to recreate it or have no record of its current attributes. On every terraform plan or apply, Terraform reads the state file, refreshes it against the real provider APIs, compares the result to your desired configuration, and generates the minimal set of create, update, or destroy actions needed. State also tracks resource metadata, dependency ordering, and output values, and because it can contain sensitive data like database passwords, it should never be committed to version control in plain text. In any team setting the state file must live in a shared remote backend such as an S3 bucket with DynamoDB locking, or Terraform Cloud, so that two engineers never run apply concurrently against stale local copies and corrupt the record of truth.
- Enables accurate diffs between desired and actual infrastructure
- Tracks resource dependencies and metadata
- Supports safe team collaboration via remote backends and locking
- Powers terraform output and cross-module references
AI Mentor Explanation
Terraform state is like a scorer’s official scorebook that records exactly which players are on the field, their current scores, and how overs have been bowled so far. Without that scorebook, a new scorer arriving mid-match would have no reliable way to know whether a batter is already out or still at the crease. Before recording the next ball, the scorer checks the book against what is actually happening on the field to catch any discrepancy. If two scorers write in the same book at once without coordinating, the record becomes corrupted and nobody trusts the final total.
Step-by-Step Explanation
Step 1
Terraform reads local or remote state
The state file (or remote backend) is loaded before any plan or apply runs.
Step 2
Refresh against real infrastructure
Terraform queries provider APIs to reconcile recorded state with actual resource attributes.
Step 3
Compute the diff
The desired configuration is compared to refreshed state to generate a create/update/destroy plan.
Step 4
Apply and update state
After changes are applied, Terraform writes the new resource IDs and attributes back into state.
What Interviewer Expects
- Understanding that state maps config resources to real infrastructure IDs
- Knowledge of why state must live in a locked remote backend for teams
- Awareness that state can contain sensitive values and should not be committed in plain text
- Ability to explain terraform plan/apply/refresh in terms of state reconciliation
Common Mistakes
- Committing terraform.tfstate to a public git repository
- Running apply from two machines against local state with no locking
- Manually editing the state file instead of using terraform state commands
- Forgetting that deleting state does not delete the underlying cloud resources
Best Answer (HR Friendly)
“Terraform state is basically the source of truth that tells Terraform what infrastructure it already created, so it does not try to rebuild things that exist or lose track of what it is managing. We always store it remotely with locking enabled, like in an S3 bucket with DynamoDB, so the whole team can safely collaborate without two people applying changes at the same time and corrupting the record.”
Code Example
terraform {
backend “s3” {
bucket = "my-tfstate-bucket"
key = "prod/network/terraform.tfstate"
region = "us-east-1"
dynamodb_table = "tf-state-locks"
encrypt = true
}
}
# Inspect state without editing it directly
terraform state list
terraform state show aws_instance.webFollow-up Questions
- What happens if the state file is deleted but the resources still exist?
- How does Terraform state locking prevent concurrent apply conflicts?
- What is the difference between terraform refresh and terraform plan?
- How would you migrate state from local to a remote backend safely?
MCQ Practice
1. What is the primary purpose of Terraform state?
State tracks which real infrastructure objects correspond to each resource block, enabling accurate diffs on future runs.
2. Why is remote state with locking recommended for teams?
Locking ensures only one apply can modify state at a time, preventing race conditions across a team.
3. What risk does committing terraform.tfstate to a public repo create?
State files can contain plaintext sensitive attributes, so committing them publicly is a security risk.
Flash Cards
What is Terraform state? — A file mapping configuration resources to real infrastructure objects and their attributes.
Why use a remote backend? — To share state across a team safely with locking to prevent concurrent corruption.
What can state files contain? — Potentially sensitive resource attributes like passwords or keys.
What does terraform refresh do? — Reconciles recorded state with the actual current state of real infrastructure.