Advanced Terraform Cloud-Scale State Cheatsheet

Terraform has become the industry standard for Infrastructure as Code (IaC). However, running Terraform at cloud-scale requires robust state management, modular component designs, dynamic loops, and safe state refactoring techniques to avoid accidental resource destruction.

This reference sheet covers remote backend architectures, state commands, dynamic configuration blocks, import strategies, and resource refactoring.

Configuring Secure Remote State Backends

Never store state files on local machines in production. Use a remote backend with access controls and concurrency state locking.

terraform {
  required_version = ">= 1.7.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  # Store state in AWS S3 and lock state modifications with DynamoDB
  backend "s3" {
    bucket         = "meshworld-terraform-production-state"
    key            = "global/s3/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "meshworld-terraform-locks"
    encrypt        = true
  }
}

Mastering Dynamic Blocks & Loops

To avoid copy-pasting configurations, use dynamic blocks to construct repetitive settings (such as security group rules or ingress rules).

variable "ingress_rules" {
  type = list(object({
    port        = number
    description = str
  }))
  default = [
    { port = 80, description = "Allow HTTP" },
    { port = 443, description = "Allow HTTPS" },
    { port = 22, description = "Allow SSH Admin access" }
  ]
}

resource "aws_security_group" "web_sg" {
  name        = "web-server-security-group"
  description = "Dynamic rules for incoming traffic"
  vpc_id      = var.vpc_id

  # Loop over variable lists to generate ingress ports
  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      description = ingress.value.description
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

Resource Refactoring with moved Blocks

Previously, renaming a resource inside files caused Terraform to destroy the old resource and provision a new one. Modern Terraform solves this with declarative moved blocks that handle renaming within the state itself.

# Before:
# resource "aws_instance" "web_server_legacy" { ... }

# After refactoring/renaming the block:
resource "aws_instance" "web_server_v2" {
  # ...
}

# Instruct Terraform to modify state names instead of replacing instance
moved {
  from = aws_instance.web_server_legacy
  to   = aws_instance.web_server_v2
}

Managing State via CLI

Use the command line to manipulate states when fixing misconfigurations or adopting pre-existing real-world resources.

# 1. List all resources currently managed within the state file
terraform state list

# 2. View details of a specific state object
terraform state show aws_security_group.web_sg

# 3. Pull state to stdout (useful for manual backups)
terraform state pull > backup.tfstate

# 4. Remove a resource from state tracking (keeps the physical resource intact)
terraform state rm aws_instance.web_server_legacy

# 5. Adopting existing cloud resources into Terraform
# Syntax: terraform import <tf_resource_address> <cloud_provider_resource_id>
terraform import aws_instance.web_server_v2 i-071a1795c612babc4

Implementing Import Blocks

Modern Terraform allows you to define imports declaratively inside your configurations instead of executing one-off CLI commands.

# 1. Declare the import target
import {
  to = aws_instance.imported_web_server
  id = "i-091b2795c712cef9"
}

# 2. Define the matching resource block configuration
resource "aws_instance" "imported_web_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"
  # ...
}