Secure Terraform State by Implementing a Lock Mechanism with Amazon S3 and DynamoDB

Overview

Terraform is a potent solution for managing and deploying resources across many cloud providers in the rapidly changing field of cloud infrastructure management.

But when your infrastructure gets more complicated and involves more team members, ensuring your
Terraform state is secure and consistent becomes even more important. One efficient approach is using Amazon S3 and Amazon DynamoDB to construct a strong locking mechanism.

Introduction

Embarking on cloud infrastructure management, this article explores the significance of the Terraform state and the need for a strong locking system. Learn how to manage Terraform state in a versioned, collaborative, and safe manner by integrating Amazon S3 and Amazon DynamoDB. Use our approach to use Amazon DynamoDB’s locking mechanism and Amazon S3’s storage capacity to strengthen your infrastructure management with scalability and dependability.

Pioneers in Cloud Consulting & Migration Services

Reduced infrastructural costs
Accelerated application deployment

Get Started

What is State and Why it is important in Terraform

The recorded data on the infrastructure Terraform oversees is called the “state” in Terraform. This contains information about the resources, their status as of right now, dependencies, and different configuration options. In essence, the Terraform state is a moment-in-time snapshot of the infrastructure.

A file with the ‘terraform.tfstate’ default name contains the Terraform state. The format of this file can be either HCL or JSON. It is essential for monitoring the deployed infrastructure’s condition as it tells Terraform what resources are available and how they are set up.

When it comes to keeping track of the present condition of your infrastructure, terraform mostly depends on its state file. This state file is an essential part because it includes details about the resources Terraform controls, their dependencies, and other metadata. Maintaining a single source of truth, avoiding disputes, and fostering teamwork depends on managing this situation.

Step-by-Step Guide

Step 1: In your current working directory, make a file called “provider.tf.”

terraform { 

  required_providers { 

    aws = { 

      source = "hashicorp/aws" 

      version = "5.31.0" 

    } 

  } 

}# Configure the AWS Provider 

provider "aws" { 

  region = "ap-south-1" 

}

terraform {

  required_providers {

    aws = {

      source = "hashicorp/aws"

      version = "5.31.0"

    }

}# Configure the AWS Provider

provider "aws" {

  region = "ap-south-1"

}

Step 2: Create another file named “s3.tf”.

resource "aws_s3_bucket" "bucket-rits" { 

    bucket = "terralockbucket" 

   

} 

resource "aws_s3_bucket_ownership_controls" "owership"{ 

    bucket = aws_s3_bucket.bucket-rits.id 

    rule { 

      object_ownership = "BucketOwnerPreferred"     

      } 

 

} 

resource "aws_s3_bucket_acl" "name" { 

    bucket = aws_s3_bucket.bucket-rits.id 

    acl = "private" 

}

resource "aws_s3_bucket" "bucket-rits" {

    bucket = "terralockbucket"

}

resource "aws_s3_bucket_ownership_controls" "owership"{

    bucket = aws_s3_bucket.bucket-rits.id

    rule {

      object_ownership = "BucketOwnerPreferred"    

      }

resource "aws_s3_bucket_acl" "name" {

    bucket = aws_s3_bucket.bucket-rits.id

    acl = "private"

}

Also, make a file called “dynamodb.tf”.

resource "aws_dynamodb_table" "dynamodb-terraform-state-lock" { 

  name = "terraform-state-lock-dynamo" 

  hash_key = "LockID" 

  read_capacity = 20 

  write_capacity = 20 

  

  attribute { 

    name = "LockID" 

    type = "S" 
}
}

resource "aws_dynamodb_table" "dynamodb-terraform-state-lock" {

  name = "terraform-state-lock-dynamo"

  hash_key = "LockID"

  read_capacity = 20

  write_capacity = 20

  attribute {

    name = "LockID"

    type = "S"

}

Step 3: Create a file called “backend.tf”.

terraform { 

  backend "s3" { 

    encrypt = true     

    bucket = "terralockbucket" 

    dynamodb_table = "terraform-state-lock-dynamo" 

    key    = "terraform.tfstate" 

    region = "ap-south-1" 

  } 

}

terraform {

  backend "s3" {

    encrypt = true    

    bucket = "terralockbucket"

    dynamodb_table = "terraform-state-lock-dynamo"

    key    = "terraform.tfstate"

    region = "ap-south-1"

  }

Step 4: Go ahead and start our backend by running terraform init. After that, we’ll run a terraform apply to see what occurs.

Problem solving with state lock error.

Testing our state lock with Amazon DynamoDB.

Step 5: Attempting to delete our Terraform files is the last test. Terraform Destroy won’t be able to launch without access to the state lock if we have one.

Key Benefits

Concurrency Control: To prevent conflicts and preserve consistency, only one Terraform action at a time can alter the state with the Amazon DynamoDB locks.

Versioned State: You can monitor changes to your Terraform state over time with Amazon S3’s versioning feature, making it simple to roll back changes in the event of an issue.
Durability and Availability: Your Terraform state is safe and accessible even during unplanned failures because of Amazon S3’s resilience and DynamoDB’s high availability.
Teamwork: Integrating Amazon S3 and Amazon DynamoDB facilitates smooth teamwork by enabling participants to work on the same infrastructure code without compromising data integrity.

Conclusion

Terraform’s state lock mechanism is an essential safety net for securely and cooperatively managing infrastructure settings. It averts conflicts and data damage that may result from simultaneous alterations by requiring exclusive access to the Terraform state file throughout operations. With its diverse backend choices and automatic lock management, Terraform offers flexibility to accommodate a range of infrastructure configurations and collaboration requirements. Adopting state locks promotes a safe and regulated environment for development and deployment by guaranteeing the dependability and consistency of Terraform-managed infrastructure.

Drop a query if you have any questions regarding Terraform and we will get back to you quickly.

Empowering organizations to become ‘data driven’ enterprises with our Cloud experts.

Reduced infrastructure costs
Timely data-driven decisions

Get Started

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.

CloudThat is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, Microsoft Gold Partner, AWS Training Partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, AWS Microsoft Workload Partners, Amazon EC2 Service Delivery Partner, and many more.

To get started, go through our Consultancy page and Managed Services Package, CloudThat’s offerings.

FAQs

1. hy should state locking be done with Amazon DynamoDB?

ANS: – Terraform uses Amazon DynamoDB as a dependable backend for state locking. Because of its NoSQL design, locking operations may be completed quickly and reliably, essential for avoiding concurrent updates. Concurrency management is improved with Amazon DynamoDB, which ensures that only one Terraform action can change the state at any moment.

2. Can I lock states using different backends?

ANS: – Yes, Terraform supports several state-locking backends, such as HashiCorp Consul, local file locks, and others. The backend you choose will rely on your tastes, collaboration demands, and infrastructure requirements.

3. What are the advantages of versioning Terraform state files on Amazon S3?

ANS: – Terraform state file modifications may be monitored over time with Amazon S3 versioning. This feature gives you a history of changes, which makes it simpler to examine, undo, and comprehend how your infrastructure has changed over time.