---
name: "terraform-state-s3-dynamodb"
description: "Configure secure remote state storage with server-side encryption and distributed locking."
metadata:
  author: "HashiCorp"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "setup terraform remote s3 backend"
  - "enable dynamodb state locking terraform"
  - "migrate terraform state"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Terraform Remote S3 State & DynamoDB State Locking

Configures Terraform backend: storing state in AWS S3 with AES256/KMS encryption, versioning, preventing race conditions with DynamoDB state locking (LockID), and migrating local state.

## When to Invoke
Invoke this skill whenever you need to:
- setup terraform remote s3 backend
- enable dynamodb state locking terraform
- migrate terraform state

## Execution SOP & Rules
1. Create dedicated S3 bucket with versioning enabled and public access completely blocked.
2. Create DynamoDB table with single primary key LockID (String type).
3. Declare terraform { backend 's3' { bucket = '...' dynamodb_table = '...' } } in backend.tf.
4. Execute terraform init -migrate-state to transfer state files safely.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.