State storage and remote backends

Terraform must store state to map real-world resources to your configuration, track metadata, and improve performance; prior to any operation it refreshes state against the real infrastructure to decide which changes to make. By default each workspace's state lives in a local terraform.tfstate file with a terraform.tfstate.backup copy of the previous state, but local storage limits collaboration and risks losing state. HashiCorp recommends storing state in HCP Terraform or a remote backend, and warns against version control or any storage without state locking and secure access control, because state can contain secrets. Configure a single backend block nested in the top-level terraform block; it cannot reference input variables or other named values, and the default backend is local while some remote backends lock state during operations. Supply backend credentials through environment variables rather than -backend-config or hardcoded values, which Terraform writes into the .terraform subdirectory and plan files. Never edit the JSON state directly; use the terraform state CLI command for modifications. Scope: Terraform. Reviewed October 4, 2026.