State Readiness Checklist

Purpose

This checklist verifies the state is ready for production use. Run through every item quarterly to ensure the state is secure, backed up, and recoverable.

Checklist

• State is in a remote backend, not local. (critical)
• State backend is encrypted at rest (KMS or equivalent). (critical)
• State backend access is least-privilege (read for operators, write for change managers). (critical)
• State backend versioning is enabled. (critical)
• State backups are taken daily with offsite copies. (critical)
• State restore is tested at least quarterly. (critical)
• State lock mechanism is configured (e.g. DynamoDB for S3). (critical)
• State access is logged and audited. (warn)
• State is not in Git (.gitignore excludes .terraform.tfstate). (critical)
• Lockfile (.terraform.lock.hcl) is committed to Git. (warn)

Verification

The checklist is complete when every item is checked. A critical item unchecked is a blocker.

Escalation

If a critical item cannot be satisfied, escalate to the engineering manager or the security team.