The Complete Production SOP: How to Deploy and Run Terraform Remote S3 State & DynamoDB State Locking in Autonomous AI Agents

---
name: "terraform-state-s3-dynamodb"
description: "Configure secure remote state storage with server-side encryption and distributed locking."
metadata:
  author: "HashiCorp"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "setup terraform remote s3 backend"
  - "enable dynamodb state locking terraform"
  - "migrate terraform state"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Terraform Remote S3 State & DynamoDB State Locking SOP
1. S3 bucket must enforce AES256 or aws:kms encryption, versioning, and public_access_block.
2. DynamoDB lock table must have hash_key = "LockID" of type String.
3. backend.tf must declare backend "s3" with bucket, key, region, and dynamodb_table.
4. Migration must use terraform init -migrate-state.

resource "aws_s3_bucket" "tf_state" {
  bucket        = "prod-corp-tfstate-${data.aws_caller_identity.current.account_id}"
  force_destroy = false
}

resource "aws_s3_bucket_versioning" "versioning" {
  bucket = aws_s3_bucket.tf_state.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "encryption" {
  bucket = aws_s3_bucket.tf_state.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_dynamodb_table" "tf_locks" {
  name         = "terraform-state-locks"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"
  attribute {
    name = "LockID"
    type = "S"
  }
}

terraform {
  required_version = ">= 1.5.0"
  backend "s3" {
    bucket         = "prod-corp-tfstate-123456789012"
    key            = "production/vpc/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-state-locks"
    encrypt        = true
  }
}

#!/usr/bin/env bash
set -euo pipefail

echo "Validating Terraform configurations..."
terraform fmt -check
terraform validate

echo "Checking for residual uncommitted local state..."
if [ -f "terraform.tfstate" ]; then
  echo "ERROR: Local state file still exists! Ensure migration completed successfully." >&2
  exit 1
fi
echo "Remote S3 and DynamoDB locking verification passed."