Skip to content

OpenTofu - S3 & DynamoDB for Remote State Storage & Locking

Overview

Use this tofu configuration to create the S3 bucket & DynamoDB table needed to use OpenTofu Remote State Storage & Locking.

What is the OpenTofu Remote State?

Read the official definition by Hashicorp.

leverage-ref-arch-tf

Figure: OpenTofu remote state store & locking necessary AWS S3 bucket and DynamoDB table components. (Source: binbash Leverage, "Terraform Module: Terraform Backend", Terraform modules registry, accessed December 3rd 2020).

Prerequisites

OpenTofu repo structure + state backend initialization

  1. Ensure you have Leverage CLI installed in your system
  2. Refer to Configuration Pre-requisites to understand how to set up the configuration files required for this layer. Where you must build your OpenTofu Reference Architecture account structure
  3. Leveraged by the Infrastructure as Code (IaC) Library through the terraform-aws-tfstate-backend module

Set up

Steps to initialize your tf-backend

  1. At the corresponding account dir, eg: /shared/base-tf-backend then,
  2. Run leverage tofu init --skip-validation
  3. Run leverage tofu plan, review the output to understand the expected changes
  4. Run leverage tofu apply, review the output once more and type yes if you are okay with that

  5. This should create a terraform.tfstate file in this directory but we don't want to push that to the repository so let's push the state to the backend we just created

    • Open config.tf and uncomment the following lines: 
        # backend "s3" {
  #   key = "shared/tf-backend/terraform.tfstate"
  # }
    • Run leverage tofu init and type yes when OpenTofu asks if you want to import the state to the S3 backend
    • Done. You can remove terraform.tfstate now (and also terraform.tfstate.backup if available)

Expected workflow after set up

⚠ This video is outdated! asciicast

OpenTofu Remote State

In the base-tf-backend folder you should find the definition of the infrastructure that needs to be deployed before you can get to work with anything else.

IMPORTANT

This is only needed if the backend was not created yet. If the backend already exists just use it.