HashiCorp Terraform Associate (004) Question 170
Single answer6c Configure remote state using the backend blockA team has been storing Terraform state locally for an AWS-based production environment. To improve collaboration, they add the following configuration to their root module:
terraform { backend "s3" { bucket = "company-tf-state-prod" key = "network/terraform.tfstate" region = "us-east-1" dynamodb_table = "terraform-state-locks" encrypt = true } }
When a team member runs terraform plan, Terraform reports that backend initialization is required. The team wants to migrate the existing local state into the new remote backend with the least risk of losing tracked infrastructure. What should they do next?
- A
Run
terraform init -migrate-stateso Terraform initializes the S3 backend and offers to copy the existing local state to the remote backend. - B
Run
terraform applyfirst so Terraform creates the S3 backend configuration in state, then rerunterraform plan. - C
Run
terraform refreshto synchronize the local state with AWS before Terraform can switch from a local backend to S3. - D
Manually upload
terraform.tfstateto the S3 bucket, then runterraform init -reconfigureso Terraform adopts it automatically.
Show answer and explanation
Correct answer: A
Explanation
When configuring remote state with a backend block, Terraform requires terraform init to initialize or reinitialize the working directory. If you are changing from one backend to another, such as from local state to an S3 backend, terraform init -migrate-state is the appropriate command because it migrates existing state to the new backend rather than forcing users to move files manually. For the S3 backend, the bucket and optional DynamoDB lock table are external prerequisites; Terraform does not create them through the backend block itself. This aligns with Terraform backend documentation and HashiCorp guidance on backend reconfiguration and state migration best practices.
- A. Correct.
Correct. After adding or changing a backend block, Terraform requires reinitialization with
terraform init. Using-migrate-stateis the safest way to move existing state from the current backend (local, in this scenario) to the new remote backend. Terraform initializes the backend and migrates the state so future operations use the remote state in S3. This is the recommended workflow when changing backend configuration. - B. Incorrect.
Incorrect.
terraform applydoes not initialize or migrate backend configuration. Backend settings are handled duringterraform init, not as managed infrastructure in Terraform state. Also, the backend block itself does not create the S3 bucket or DynamoDB table; those resources must already exist or be created separately. - C. Incorrect.
Incorrect.
terraform refreshis not the command used to switch or migrate backends. Refresh updates state data based on real infrastructure, but it does not reconfigure Terraform's backend or move state between local and remote storage. A candidate might choose this if they confuse state synchronization with backend migration. - D. Incorrect.
Incorrect. Manually uploading the state file is risky and not the recommended migration workflow.
terraform init -reconfiguretells Terraform to disregard the previous backend configuration and reinitialize, but it does not perform an automatic state migration from a manually uploaded file. This can lead to confusion or state inconsistency if the object path, metadata, or locking workflow are not handled properly.