Terraform Fundamentals - State

Learn how Terraform's state file (terraform.tfstate) works, why it's critical to infrastructure management?

Apr 29, 2025

If you have been following my previous posts, you have probably noticed how smoothly everything works when we run terraform apply. But have you ever wondered how Terraform keeps track of what resources it’s created, modified, or destroyed? That’s where the terraform.tfstate file comes into play.

What is `terraform.tfstate`?

At its core, the terraform.tfstate file holds the current state of the infrastructure. It’s a JSON file that records the exact state of the infrastructure managed by Terraform at any given point. This includes metadata about each resource: their IDs, relationships, configuration values, and even computed attributes returned by the provider after creation. When we run commands like terraform plan or terraform apply, Terraform compares this current state with the configuration to calculate the difference and determine what to create, update, or destroy. Without this file, Terraform would essentially be flying blind, unaware of what’s already been deployed or what needs to be updated.

Follow my journey of 100 Days of Red Team on WhatsApp, Telegram or Discord.

Why it matters (and why it’s sensitive)?

Because terraform.tfstate contains all that juicy information about the infrastructure, it’s sensitive by nature. It doesn’t just track the existence of resources; it can also store sensitive values like passwords, API tokens, or secrets for cloud services. Accidentally committing the state file to a public repository or mishandling its storage can lead to massive security risks. Imagine exposing credentials for production environment because of a simple oversight—that’s a nightmare no one wants to deal with.

Here’s an example from a state file that includes a managed database:

{
  "type": "aws_db_instance",
  "name": "prod_db",
  "instances": [
    {
      "attributes": {
        "endpoint": "prod-db.cluster-xyz.us-east-1.rds.amazonaws.com",
        "username": "admin",
        "password": "SuperSecretPass123"
      }
    }
  ]
}

This is why treating your state file with the same level of care as any other sensitive data is critical. Proper state management ensures both operational consistency and security, keeping environments safe and predictable.

Storing It Locally vs. Remotely

By default, Terraform stores the state file locally on the machine in the project directory. While this is fine for learning or small personal projects, it quickly becomes problematic in team environments. Local state storage can lead to configuration drift, conflicts, and a lack of visibility into who changed what and when.

To solve this, Terraform supports remote state storage using backends like HCP Terraform, HashiCorp Consul, Amazon S3, Azure Blob Storage, Google Cloud Storage, Alibaba Cloud OSS, and more. Using remote backends not only centralizes the state but also introduces state locking mechanisms, preventing multiple people from modifying infrastructure at the same time—saving from those "uh-oh" moments when two team members accidentally overwrite each other’s changes.

Remote storage also gives the flexibility to enforce encryption, versioning, and access control, further tightening your security posture. It’s a small setup effort with a big payoff in terms of reliability and safety. For example, storing your state in S3 with server-side encryption and versioning enabled helps in rolling back accidental changes and prevent data loss. Adding DynamoDB for locking ensures only one terraform apply can run at a time.

Why attackers love state files

Now, let’s put on our red team hat for a moment. If we are thinking like an attacker, what’s more enticing than a file that contains a blueprint of an organization’s entire cloud infrastructure and secrets? That’s exactly what a poorly managed terraform.tfstate file provides.

From a red teaming perspective, mishandled state files are low-hanging fruit. If state files are left in unsecured storage or inadvertently pushed to public repositories, attackers can easily gain insight into the cloud architecture, pivot through resources, and potentially extract secrets that give them access to most critical systems. This isn’t hypothetical; there have been real-world breaches where exposed state files became the initial foothold for attackers.

TL;DR
- Terraform’s terraform.tfstate file acts as its memory, storing the current state of all managed resources. 
- It also contains sensitive data like IPs, credentials, and infrastructure metadata. 
- Mismanaging this file—especially by storing it locally or exposing it via version control—can lead to serious security breaches. 
- Remote backends provide secure, centralized, and auditable state management. - Red team operators can exploit exposed state files to extract secrets, map cloud infrastructure, and pivot deeper into environments.