Skip to content

Terraform - S3 & DynamoDB for Remote State Storage & Locking

Overview

Use this terraform configuration files to create the S3 bucket & DynamoDB table needed to use Terraform Remote State Storage & Locking.

What is the Terraform Remote State?

Read the official definition by Hashicorp.

leverage-ref-arch-tf

Figure: Terraform remote state store & locking necessary AWS S3 bucket and DynamoDB table components. (Source: binbash Leverage, "Terraform Module: Terraform Backend", Terraform modules registry, accessed December 3rd 2020).

Prerequisites

Terraform repo structure + state backend initialization

  1. Ensure you have Leverage CLI installed in your system
  2. Refer to Configuration Pre-requisites to understand how to set up the configuration files required for this layer. Where you must build your Terraform Reference Architecture account structure
  3. Leveraged by the Infrastructure as Code (IaC) Library through the terraform-aws-tfstate-backend module

Set up

Steps to initialize your tf-backend

  1. At the corresponding account dir, eg: /shared/base-tf-backend then,
  2. Run leverage terraform init --skip-validation
  3. Run leverage terraform plan, review the output to understand the expected changes
  4. Run leverage terraform apply, review the output once more and type yes if you are okay with that

  5. This should create a terraform.tfstate file in this directory but we don't want to push that to the repository so let's push the state to the backend we just created

    • Open config.tf and uncomment the following lines: 
        # backend "s3" {
  #   key = "shared/tf-backend/terraform.tfstate"
  # }
    • Run leverage terraform init and type yes when Terraform asks if you want to import the state to the S3 backend
    • Done. You can remove terraform.tfstate now (and also terraform.tfstate.backup if available)

Expected workflow after set up

⚠ This video is outdated! asciicast

Terraform Remote State

In the base-tf-backend folder you should find the definition of the infrastructure that needs to be deployed before you can get to work with anything else.

IMPORTANT: THIS IS ONLY NEEDED IF THE BACKEND WAS NOT CREATED YET. IF THE BACKEND ALREADY EXISTS YOU JUST USE IT.