State Locking

// From internal/states/statemgr/locker.go
type LockInfo struct {
    ID        string    // Unique lock ID
    Operation string    // Operation being performed
    Info      string    // Additional information
    Who       string    // User and hostname
    Version   string    // Terraform version
    Created   time.Time // When lock was acquired
    Path      string    // State path
}

// From internal/states/statemgr/locker.go
type Locker interface {
    Lock(info *LockInfo) (string, error)
    Unlock(id string) error
}

// From internal/command/clistate/state.go:56
type Locker interface {
    WithContext(ctx context.Context) Locker
    Lock(s statemgr.Locker, reason string) tfdiags.Diagnostics
    Unlock() tfdiags.Diagnostics
    Timeout() time.Duration
}

// From internal/command/state_mv.go:90
stateLocker := clistate.NewLocker(
    c.stateLockTimeout,
    views.NewStateLocker(arguments.ViewHuman, c.View)
)

// From internal/command/state_mv.go:91
if diags := stateLocker.Lock(stateMgr, "state-mv"); diags.HasErrors() {
    c.showDiagnostics(diags)
    return 1
}
defer func() {
    if diags := stateLocker.Unlock(); diags.HasErrors() {
        c.showDiagnostics(diags)
    }
}()

// From internal/command/clistate/state.go:117
ctx, cancel := context.WithTimeout(l.ctx, l.timeout)
defer cancel()

err := slowmessage.Do(LockThreshold, func() error {
    id, err := statemgr.LockWithContext(ctx, s, lockInfo)
    l.lockID = id
    return err
}, l.view.Locking)

// From internal/command/clistate/state.go:24
const LockErrorMessage = `Error message: %s

Terraform acquires a state lock to protect the state from being written
by multiple users at the same time. Please resolve the issue above and try
again. For most commands, you can disable locking with the "-lock=false"
flag, but this is not recommended.`

// From internal/command/clistate/state.go:31
const UnlockErrorMessage = `Error message: %s

Terraform acquires a lock when accessing your state to prevent others
running Terraform to potentially modify the state at the same time. An
error occurred while releasing this lock. This could mean that the lock
did or did not release properly. If the lock didn't release properly,
Terraform may not be able to run future commands since it'll appear as if
the lock is held.

In this scenario, please call the "force-unlock" command to unlock the
state manually. This is a very dangerous operation since if it is done
erroneously it could result in two people modifying state at the same time.`

// From internal/command/clistate/state.go:23
const LockThreshold = 400 * time.Millisecond

terraform apply -lock=false
terraform state rm -lock=false aws_instance.example

// From internal/states/statemgr/lock.go:16
type LockDisabled struct {
    Inner Full
}

func (s *LockDisabled) Lock(info *LockInfo) (string, error) {
    return "", nil  // No-op
}

func (s *LockDisabled) Unlock(id string) error {
    return nil  // No-op
}

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    
    # DynamoDB table for state locking
    dynamodb_table = "terraform-state-locks"
  }
}

resource "aws_dynamodb_table" "terraform_locks" {
  name           = "terraform-state-locks"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = {
    Name = "Terraform State Locks"
  }
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:PutItem",
        "dynamodb:GetItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/terraform-state-locks"
    }
  ]
}

# Get lock ID from error message
terraform force-unlock <lock-id>

terraform force-unlock a1b2c3d4-5678-90ef-ghij-klmnopqrstuv

Do you really want to force-unlock?
  Terraform will remove the lock on the remote state.
  This will allow local Terraform commands to modify this state, even though it
  may be still be in use. Only 'yes' will be accepted to confirm.

  Enter a value: yes

aws dynamodb get-item \
  --table-name terraform-state-locks \
  --key '{"LockID": {"S": "my-bucket/prod/terraform.tfstate-md5"}}'

consul kv get terraform/state/locks/production

Error: Error acquiring the state lock

Error message: ConditionalCheckFailedException: The conditional request failed
Lock Info:
  ID:        a1b2c3d4-5678-90ef-ghij-klmnopqrstuv
  Path:      my-bucket/prod/terraform.tfstate
  Operation: apply
  Who:       [email protected]
  Version:   1.5.0
  Created:   2023-10-15 14:30:00 UTC

Error: Error acquiring the state lock

Error message: timeout while waiting for state lock

Error: Error acquiring the state lock

Error message: AccessDenied: User not authorized to perform dynamodb:PutItem

# 1. Verify process is not running
ps aux | grep terraform

# 2. Check for lock in backend
aws dynamodb get-item --table-name terraform-state-locks ...

# 3. Force unlock
terraform force-unlock <lock-id>

# 4. Verify state integrity
terraform plan