Terraform State
also called IaC State File
The file mapping declared resources to real infrastructure, without which the tool cannot tell what it already created — and which becomes critical infrastructure in its own right.
Declarative infrastructure tools need a record of what they have made. The state file holds the mapping from configuration to real resource identifiers, plus attributes read back from the provider.
Three properties make it consequential:
It contains secrets. Generated passwords, keys and connection strings are stored in plaintext in state regardless of how carefully they are handled in configuration. State must therefore be encrypted at rest and access-controlled as tightly as the infrastructure it describes.
Concurrent writes corrupt it. Two applies at once produce a state that no longer matches reality, after which the tool may attempt to create resources that exist or destroy ones it has lost track of. Remote backends with locking are not optional for team use.
Losing it is worse than losing the code. Configuration can be rewritten; state maps it to running resources. Without it the tool believes nothing exists and will attempt to create everything — against infrastructure already running. Versioning and backup of the state store is mandatory, and import is the painful recovery path.
The related discipline is splitting state by blast radius: one enormous state file means every change plans against everything and one corruption affects everything. Separate state per environment and per major component.