Local vs Remote State

mkdir terraform-state-bootstrap
cd terraform-state-bootstrap
touch versions.tf main.tf outputs.tf

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  # No backend block — this bootstrap config intentionally uses local state
  # It creates the S3 bucket and DynamoDB table that all other projects use
}

provider "aws" {
  region = "us-east-1"
}

# S3 bucket to store all Terraform state files for this organisation
resource "aws_s3_bucket" "terraform_state" {
  bucket = "acme-terraform-state-${data.aws_caller_identity.current.account_id}"  # Account ID makes name unique

  tags = {
    Name      = "Terraform State Bucket"
    ManagedBy = "Terraform"
    Purpose   = "terraform-state"
  }

  lifecycle {
    prevent_destroy = true  # Never allow this bucket to be destroyed — all state lives here
  }
}

# Enable versioning — every state file write creates a new version
# This is the recovery mechanism if state becomes corrupted
resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  versioning_configuration {
    status = "Enabled"  # Enabled = versioning on. Suspended = versioning paused but history kept.
  }
}

# Encrypt all objects at rest using AES-256
# State files contain sensitive data — encryption is mandatory
resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"  # S3-managed keys — no additional cost or key management
    }
  }
}

# Block all public access — a state bucket must never be publicly accessible
resource "aws_s3_bucket_public_access_block" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  block_public_acls       = true  # Block any attempt to set public ACLs
  block_public_policy     = true  # Block any attempt to set a public bucket policy
  ignore_public_acls      = true  # Ignore public ACLs already on objects
  restrict_public_buckets = true  # Restrict access to the bucket owner only
}

# DynamoDB table for state locking
# When any Terraform process runs apply, it writes a lock here
# Any concurrent apply sees the lock and waits
resource "aws_dynamodb_table" "terraform_locks" {
  name         = "terraform-state-lock"
  billing_mode = "PAY_PER_REQUEST"  # No provisioned capacity — pay only for actual lock operations

  # LockID is the partition key Terraform uses — this exact name is required
  hash_key = "LockID"

  attribute {
    name = "LockID"
    type = "S"  # S = String — LockID is always a string
  }

  tags = {
    Name      = "Terraform State Lock Table"
    ManagedBy = "Terraform"
    Purpose   = "terraform-state-lock"
  }

  lifecycle {
    prevent_destroy = true  # Destroying this table while projects are applying corrupts state
  }
}

# Data source to get current account ID for the unique bucket name
data "aws_caller_identity" "current" {}

output "state_bucket_name" {
  description = "S3 bucket name — use this in every project's backend configuration"
  value       = aws_s3_bucket.terraform_state.bucket
}

output "state_bucket_arn" {
  description = "S3 bucket ARN — use this in IAM policies granting state access"
  value       = aws_s3_bucket.terraform_state.arn
}

output "dynamodb_table_name" {
  description = "DynamoDB table name — use this in every project's backend configuration"
  value       = aws_dynamodb_table.terraform_locks.name
}

output "backend_config_snippet" {
  description = "Copy this block into any project's versions.tf to use this remote backend"
  value = <<-EOT
    backend "s3" {
      bucket         = "${aws_s3_bucket.terraform_state.bucket}"
      key            = "PROJECT_NAME/ENV/terraform.tfstate"
      region         = "us-east-1"
      encrypt        = true
      dynamodb_table = "${aws_dynamodb_table.terraform_locks.name}"
    }
  EOT
}

terraform init
terraform apply

# Step 1 — add the backend block to versions.tf in your existing project
# Replace PROJECT_NAME and ENV with the appropriate values for this project

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  # Add this block — run terraform init after saving to trigger migration
  backend "s3" {
    bucket         = "acme-terraform-state-123456789012"  # From bootstrap output
    key            = "lesson-15/dev/terraform.tfstate"     # Unique path for this project
    region         = "us-east-1"
    encrypt        = true                                  # Always true
    dynamodb_table = "terraform-state-lock"               # From bootstrap output
  }
}

provider "aws" {
  region = "us-east-1"
}

# Step 2 — run terraform init to trigger the migration
terraform init

# Normal apply — lock is acquired, apply runs, lock is released automatically
terraform apply

# What happens if two engineers run apply at the same time
# Engineer A runs first — acquires the lock
# Engineer B runs simultaneously — sees the lock and gets this error:

# Recommended key naming convention: team/project/environment/terraform.tfstate
# Examples for a multi-team organisation:

# Platform team — networking infrastructure
key = "platform/networking/prod/terraform.tfstate"

# Platform team — shared services
key = "platform/shared-services/prod/terraform.tfstate"

# Application team — payments microservice
key = "payments/application/prod/terraform.tfstate"

# Application team — payments database
key = "payments/database/prod/terraform.tfstate"

# DevOps team — CI/CD infrastructure
key = "devops/cicd/prod/terraform.tfstate"

# Each team's state is isolated — no team can accidentally overwrite another's state
# All states benefit from the same bucket's versioning and encryption