🔗 Video: Day 4: State File & S3 Backend

⏱️ Prerequisite: Day 3 (S3 Bucket Lab) ✅

📁 Repo: /day04/ → TASK.md

🎯 Goal: Move from local (risky!) to remote, encrypted, locked state — the foundation of production-ready Terraform.

🧠 Why State Matters: Terraform’s “Memory”

💡 Terraform is stateful — unlike tools like CloudFormation, it remembers what it created.

How It Works:

flowchart LR
A[main.tf] -->|Desired State| B[Terraform Core]
C[terraform.tfstate] -->|Actual State| B
B -->|Compare| D{{Drift?}}
D -->|Yes| E[Plan: 1 to add, 2 to change…]
D -->|No| F[“No changes.”]

✅ State file (terraform.tfstate) stores:

• Resource IDs (e.g., s3-abc123, vpc-xyz789)
• Attributes (e.g., bucket_region, vpc_cidr)
• Provider config metadata
• 🔐 Sensitive data (e.g., AWS account ID, ARNs — not secrets, but still confidential!)

⚠️ Critical:

Editing .tfstate manually = breaking Terraform’s trust.

→ Leads to state drift, failed plans, and orphaned resources.

🚫 Problems with Local State (Default)

✅ Real-world analogy:

Local state = saving your bank ledger on a sticky note.

Remote backend = using a vault with audit logs and dual control.