Terraform state explained (for the 004 exam)
Updated September 6, 2026
State is one of the heaviest Terraform Associate 004 topics. Here is what state is, remote backends, locking, and the state commands you must know.
If there is one topic that decides Terraform Associate results, it is state. Terraform state is how Terraform remembers what it has built, and the 004 exam tests it heavily. Understand the concepts below and you remove a whole category of exam risk.
What state actually is
State is a file (by default terraform.tfstate) that maps the resources in your configuration to the real objects in your provider, along with metadata and dependencies. When you run plan, Terraform compares your configuration, the state, and the real world to work out what must change. Without state, Terraform would have no memory of what it manages.
Local vs remote backends
By default state lives on your local disk, which is fine for solo experiments but dangerous for teams. A remote backend (such as an object store or HCP Terraform) stores state centrally so a team shares one source of truth, and it enables locking and access control. Expect exam questions on why and when to use a remote backend.
State locking
When state is shared, two people running apply at once could corrupt it. State locking prevents that by taking a lock for the duration of an operation. Not every backend supports locking — knowing which do, and what a lock protects against, is fair exam material.
The state commands you must know
- terraform state list — list resources tracked in state
- terraform state show — inspect one resource
- terraform state mv — rename or move a resource in state (e.g. after refactoring)
- terraform state rm — stop managing a resource without destroying it
- terraform import — bring an existing real resource under Terraform management
- terraform apply -refresh-only — reconcile state with the real world (the modern replacement for the old refresh command)
Golden rule the exam expects you to know: never hand-edit the state file. Use the state commands instead.
Sensitive data lives in state
State can contain secrets (for example generated passwords), so it must be stored securely — another reason remote backends with encryption and access control matter. Expect at least one question that touches on this.
Next step
Pair this with hands-on practice: break state on purpose, then reconcile it with import and plan. See the full 004 study plan and drill it with practice exams.