Terraform state and remote backends

You'll look inside a real state file, spring the "sensitive" trap, make Terraform forget something, and watch a lock stop a second run. This carries on from episode 1's lab folder, so do that one first.

You need: Terraform 1.4 or newer (install guide) or OpenTofu (install guide), and a terminal. No cloud account. No cost. Everything stays on your computer.

1. What does state know about?

terraform state list

Eight addresses, such as module.development.terraform_data.subnet[0] and module.prod.terraform_data.network. That's the address book.

2. Open one entry

terraform state show 'module.prod.terraform_data.subnet[0]'

You'll see its id and its value, 10.20.0.0/24.

3. The sensitive trap

Add this to main.tf, then run terraform apply:

# LAB ONLY: never put a real password in code.
variable "db_password" {
  type      = string
  sensitive = true
  default   = "Sup3rS3cret!"
}

resource "terraform_data" "db" {
  input = {
    password = var.db_password
  }
}

The plan shows password = (sensitive value). Hidden on screen.

Now search the state file for it. macOS or Linux:

grep -c "Sup3rS3cret" terraform.tfstate

Windows PowerShell:

Select-String -Path terraform.tfstate -Pattern "Sup3rS3cret"

It's there, in plain text. (In our OpenTofu 1.12.6 test it appeared twice.) This is why state must be protected. Look at the file if you like, but never edit it.

4. Make Terraform forget something

terraform state rm 'module.prod.terraform_data.subnet[2]'
terraform plan

Successfully removed 1 resource instance(s). Then Plan: 1 to add: Terraform forgot it, so it plans to create it again. With a real cloud resource, that create could make a second object, or fail because the name or ID is already taken. Run terraform apply to tidy up.

5. Watch a lock work (two terminals, same folder)

Terminal 1: start a change, and don't answer the question yet.

terraform apply -var "db_password=Changed123"

Terminal 2: try to plan at the same time.

terraform plan

Error: Error acquiring the state lock, with Lock Info showing Operation: OperationTypeApply. While terminal 1 waits, a file called .terraform.tfstate.lock.info exists. Now type no in terminal 1: the lock is released.

6. Your local safety net

Next to terraform.tfstate you'll find terraform.tfstate.backup: the previous version. S3 bucket versioning is the grown-up version of this.

7. Clean up

terraform destroy

Type yes. Everything was local, so nothing else is affected.

Tested step by step with OpenTofu 1.12.6 on 30 September 2026. The lab uses only features built into both tools. With OpenTofu, type tofu instead of terraform, and messages say "OpenTofu" instead of "Terraform". It could not be run with the Terraform program itself in the test environment.