Configure Terraform Remote State with S3 and DynamoDB Backend

Terraform state is the mechanism that maps your declared HCL resources to real infrastructure objects in the cloud. By default, Terraform stores this state in a local file called terraform.tfstate, which works fine for solo experimentation but breaks down quickly in team environments: concurrent applies can corrupt the file, secrets stored in state sit unencrypted on disk, and there is no built-in mechanism to prevent two engineers from running terraform apply at the same time. Remote state backends solve all three problems by storing state in a shared, durable location with locking and encryption built in.

On AWS, the standard remote backend uses an S3 bucket for state storage and a DynamoDB table for state locking. S3 provides versioning, server-side encryption, and cross-region replication options, while DynamoDB implements a lock table that prevents concurrent modifications from corrupting state. In this lab, the S3 state bucket and DynamoDB lock table are pre-provisioned for you; you will deploy initial infrastructure using local state, configure a Terraform backend block pointing to these resources, migrate your existing local state to the remote backend, and verify that encryption and locking are working correctly.

Objectives

By completing this intermediate lab, you will be able to:

• Deploy AWS infrastructure using Terraform with local state storage
• Understand how an S3 bucket (with versioning and server-side encryption) and a DynamoDB lock table form a Terraform remote backend
• Configure a Terraform S3 backend block with bucket, key, region, and lock table settings
• Migrate existing local state to the S3 remote backend using terraform init -migrate-state
• Verify state locking behavior and confirm encryption on the stored state file

Who is this lab for?

• Cloud Engineers managing shared Terraform projects on AWS who need a reliable remote state solution
• DevOps Practitioners looking to implement state locking and encryption best practices
• Infrastructure Engineers transitioning from local Terraform workflows to team-ready remote backends