Search code examples
terraform

Terraform: shall we push state file etc. to central repository


when run "terraform apply" command, terraform will create .tfstat file (and .data) to store infrastructure.

when pushing source code to git central repository, shall we push only the code we write, or the tfstat and .data files as well?


Solution

  • You need to be aware that your tfstate file and your tfvars file can contain sensitive data. Terraform itself has capabilities for remote backends: https://www.terraform.io/intro/getting-started/remote.html

    This can be in: - Artifactory

    • Azure
    • Consul
    • Etcd
    • GCS
    • HTTP (REST)
    • Manta
    • AWS S3 (Supports locking with DynamoDB)
    • Swift

    More info can be found here: https://www.terraform.io/docs/backends/types/index.html

    When using the default behavior in terraform, syncing your state will be taken care of for you. When using AWS & DynamoDB it can even do locking of your remote state for you so you can't cause any conflicts accidentally.

    It is also still perfectly possible to implement 'remote' state yourself. All you have to do is before running an actual apply make sure you have the most recent state. And afterwards push it to sync up.