Comparison
State filevsState locking
State file
the entire record of what your infrastructure is lives in one JSON file, and it contains the database password in clear.
The concrete artefact holding infrastructure state, stored remotely so a team shares one copy. It is simultaneously the most critical and most casually treated file in the estate: losing it means the tool no longer knows anything it built, and it frequently contains secrets in plain text because resource attributes are recorded verbatim. Versioning and encrypting the backend is not optional, and neither is keeping people out of it.
Full entry →State locking
two people applied at once, and the second was refused rather than allowed to interleave writes into the same record.
Taking an exclusive lock on the state before an apply, so concurrent runs cannot corrupt it. It is what makes a shared pipeline safe and what produces the familiar 'state is locked' message when a previous run was killed halfway. Force-unlocking is the standard remedy and the standard way to cause the corruption the lock existed to prevent, so it deserves more suspicion than it usually gets.
Full entry →