6.4. Reflection Checkpoint

Key Takeaways

• A backend sets where state lives; the local backend is the default (no config), while remote backends enable team collaboration, locking, and encryption via a backend block.
• State locking prevents concurrent writes, is automatic on supporting backends, and is recovered with force-unlock; the S3 + DynamoDB pairing and HCP Terraform's built-in locking are exam staples.
• Drift is detected by refresh; refresh-only mode updates state toward reality without touching infrastructure, while a normal apply reconciles reality toward config.
• The moved block renames addresses without destroy/recreate, and removed (with destroy = false) stops managing a resource without deleting it — both are declarative, reviewable replacements for manual state surgery.

Connecting Forward

Phase 7 covers the day-two operations of keeping infrastructure healthy: bringing pre-existing resources under Terraform's management with import (and the newer import blocks), inspecting state from the CLI, and turning on verbose logging when something goes wrong. These are the troubleshooting and maintenance skills the exam's Objective 7 targets.

Self-Check Questions

• Contrast the local and remote backends across configuration, collaboration, and locking — and name the command that migrates between them.
• A CI job crashed mid-apply and now every run errors on the state lock. What command resolves this, and why is deleting state the wrong move?
• Explain the difference in direction of reconciliation between apply -refresh-only and a normal apply after drift is detected.