Skip to main content

RunBook Academy◆Terraform

Courses Overview Curriculum Toolkit Quizzes Glossary Search/

← All checklists in Terraform

Before deploymentterraform-state-readiness

State Backend Production Readiness

12 items ·9 critical ·3 warn ·0 info

Purpose

This checklist verifies the production readiness of state backend production readiness.

Checklist

Run through every item before the deployment.

Verification

The checklist is complete when every item is checked. A critical item unchecked is a deployment blocker.

Production note

Production-readiness checks for a Terraform state backend.

Critical9 items

State is in a remote backend (S3, GCS, etc.)
State backend has versioning enabled
State backend has encryption at rest enabled
State backend has locking enabled (DynamoDB / equivalent)
State backend is in a private subnet / private network
State backend access follows least privilege (no wildcard IAM)
State backup is automated and tested
State file does not contain secrets
Restoration procedure has been rehearsed

Warning3 items

State backend has lifecycle policy: retain prior versions for 90+ days
State backend has audit logging enabled (CloudTrail / equivalent)
Cross-region copy is enabled for DR

References

Terraform documentation

RunBook Academy

Production-oriented technical education for infrastructure engineers, sysadmins, SREs, DevOps, and security engineers.

Courses

Linux
Docker & Containers
Proxmox VE
Ansible
Terraformcoming soon
Observability

Platform

Course catalogue
Search
Glossary
About

Terraform versions

Terraform CLIv1.9.x· verified 2026-08-12
OpenTofuv1.7.x· verified 2026-08-12
HCLv2.0· verified 2026-08-12
bpg/proxmox providerv0.66+· verified 2026-08-12
hashicorp/local providerv2.5+· verified 2026-08-12
hashicorp/null providerv3.2+· verified 2026-08-12
hashicorp/random providerv3.6+· verified 2026-08-12
hashicorp/http providerv3.4+· verified 2026-08-12
Ubuntuv24.04 LTS· verified 2026-08-12
Debianv12 (Bookworm)· verified 2026-08-12

Run this material somewhere disposable first. Course content is published as-is and without warranty. Many commands here change production state and can take a host off the network or destroy data if run on the wrong system, or on a version they were not written for. Check the versions each course targets, read the severity badge on a command block before running it, and keep a second session open when changing anything you connect through. No lab has been executed end to end by us. See About for the full note.

Terraform for Production Sysadmins: independent educational project. All product names, commands, and configuration references are used for instructional purposes only.

© 2026 RunBook Academy · Content CC BY-SA 4.0 · Code MIT