# Terraform S3 State + Locking (July 2026)

AWS Prescriptive Guidance: prefer **S3 native locking** (`use_lockfile = true`, Terraform **≥ 1.10**). DynamoDB locking is **legacy / deprecated**.

## Recommended backend

```hcl
terraform {
  backend "s3" {
    bucket       = "myorg-terraform-states"
    key          = "myapp/production/tfstate"
    region       = "us-east-1"
    encrypt      = true
    use_lockfile = true
  }
}
```

## Bucket hygiene

- [ ] Versioning on
- [ ] SSE (AES256 or KMS)
- [ ] Block public access
- [ ] Optional: dual lock (`use_lockfile` + `dynamodb_table`) only during migration

## Stuck lock

- [ ] Confirm no other apply is running
- [ ] `terraform force-unlock <LOCK_ID>` only after that confirmation

## Counter-case

Local `terraform.tfstate` on laptops is not a backup strategy — remote + versioning is.