Terraform IaC: stateful control, not application recovery

Terraform compares configuration, prior state and provider observations to propose and apply infrastructure changes. Its state maps resource addresses to remote identities and attributes; it is sensitive operational data, not a disposable cache.

Safe delivery contract

1. Pin provider selections, validate policy and use short-lived runner credentials.
2. Acquire the backend lock, refresh observations and create a saved plan.
3. Review the exact plan, including deletes and replacements.
4. Apply that saved plan, then verify service health independently.

For an S3 backend, use native lockfiles (use_lockfile = true) and bucket versioning. DynamoDB locking is deprecated. A lock coordinates Terraform writers for one state; it cannot fence a console user or another controller.

Recovery is a workflow

Creating equivalent resources in a second region does not restore databases, object data, secrets, queues, certificates, DNS or application correctness. Provision infrastructure, restore/promote data, materialize region-specific dependencies, run integrity and smoke checks, and only then shift traffic. Measure the achieved RPO and RTO in a drill.

State exposure is an incident: stop writers, preserve logs, rotate any exposed credential at its owning service, restore least privilege and verify a known good state version. Marking an output sensitive hides some display paths but does not remove the value from state.

Scenarios

Sources

• Terraform state
• S3 backend and native lockfile
• Terraform plan
• Dependency lock file