Configuring Encrypted, Versioned S3 Remote State with Native S3 Lockfiles in Terraform

Terraform makes infrastructure easier to manage by turning cloud resources into code.

But behind every Terraform project is another important piece that often gets less attention: the Terraform state file.

The state file tells Terraform which real resources belong to your configuration. It connects something like:

resource "aws_instance" "web" {
  instance_type = "t3.micro"
}

to the actual EC2 instance running in AWS.

By default, Terraform stores this information locally in:

terraform.tfstate

That may be fine while learning Terraform.

For teams and production environments, however, local state quickly becomes risky.

A better approach is to store Terraform state remotely in Amazon S3, protect it with encryption and versioning, and prevent simultaneous modifications using Terraform’s native S3 lockfile support:

use_lockfile = true

In this article, we will build that setup from the ground up.

First, What Is Terraform State?