Several engineers manage AWS resources with Terraform.
Review changes, prevent concurrent state updates, and avoid exposing sensitive state data.
Which operating practice is most appropriate?
Review configuration in Git and store Terraform state in an encrypted shared backend with state locking.
Detailed explanation
A cache does not provide infrastructure state management or locking.
A cache does not provide infrastructure state management or locking.
State can contain resource details or secrets, so public storage is unsafe.
State can contain resource details or secrets, so public storage is unsafe.
State conflicts and secret leakage become likely, and changes are difficult to track.
State conflicts and secret leakage become likely, and changes are difficult to track.
Git provides history and review, while a locked shared state prevents conflicting updates and corruption.
Git provides history and review, while a locked shared state prevents conflicting updates and corruption.
Check official documentation
Compare the following points with the official documentation.
Terraform state locking remote backend Git workflowの公式説明を確認する。
What to confirm
Gitの役割とstateバックエンドの役割を区別できる。
Key points
- Terraform state
- State locking
- Git review
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Code versus state
Git can review configuration, but it does not replace a protected state backend.
Sensitive state
State may contain resource metadata or secrets and needs encryption and access control.