1 min lesson
State, locking and drift
Say what this means in practice: "Remote state with locking is non-negotiable on a team."
Step 1 of 3
State, locking and driftthe part that bites in production
Remote state with locking is non-negotiable on a team. Two engineers applying against the same unlocked state can corrupt it and a corrupted state file is a bad afternoon. The deeper signal is how you treat drift - the gap between what code says and what the cloud actually runs.
Learn more
Advanced table
Reference table
- Concept
- Remote state
- What it is
- The recorded mapping from code to real resources
- How a strong answer handles it
- S3 backend with versioning; never local, never in git
- Concept
- State locking
- What it is
- Mutual exclusion so two applies can't race
- How a strong answer handles it
- DynamoDB lock table (or backend-native locking); CI holds the lock
- Concept
- Drift
- What it is
- Reality diverging from code (console edits, manual fixes)
- How a strong answer handles it
- Scheduled
planin CI; a non-empty plan on an unchanged branch is an alert
- Concept
- Reconciliation
- What it is
- Closing the drift gap
- How a strong answer handles it
- Import or codify the change, never re-click; ask why the bypass happened
| Concept | What it is | How a strong answer handles it |
|---|---|---|
| Remote state | The recorded mapping from code to real resources | S3 backend with versioning; never local, never in git |
| State locking | Mutual exclusion so two applies can't race | DynamoDB lock table (or backend-native locking); CI holds the lock |
| Drift | Reality diverging from code (console edits, manual fixes) | Scheduled plan in CI; a non-empty plan on an unchanged branch is an alert |
| Reconciliation | Closing the drift gap | Import or codify the change, never re-click; ask why the bypass happened |
Drift detection turns "someone changed prod" from a mystery into a ticket.
Treating drift as a shrug is the tell of someone who's run IaCInfrastructure as Code. Managing servers and cloud resources through version-controlled config files (e.g. Terraform). Press Enter for the full definition. as decoration. A console hotfix during an incident is sometimes correct - but if it never gets reconciled back into code, your next clean apply will quietly revert it and re-break prod. Drift is an incident with a delay timer.
Learn more
Optional practice
Practice: State, locking and drift
QA scheduled terraform plan runs nightly against the prod branch with no code changes and one morning it shows a non-empty plan. What does that mean and what do you do?