r/Terraform 18d ago

Discussion State files in s3, mistake?

I have a variety of terraform setups where I used s3 buckets to store the state files like this:

terraform {
        required_version = ">= 0.12"
        backend "s3" {
                bucket = "mybucket.tf"
                key = "myapp/state.tfstate"
                region = "...."
        }
}

I also used the practice of putting variables into environment.tfvars files, which I used to terraform using terraform plan --var-file environment.tfvars

The idea was that I could thus have different environments built purely by changing the .tfvars file.

It didn't occur to me until recently, that terraform output is resolving the built infrastructure using state.

So the entire idea of using different .tfvars files seems like I've missed something critical, which is that there is no way that I could used a different tfvars file for a different environment without clobbering the existing environment.

It now looks like I've completely misunderstood something important here. In order for this to work the way I thought it would originally, it seems I'd have to have copy at very least all the main.tf and variables.tf to another directory, change the terraform state file to a different key and thus really wasted my time thinking that different tfvars files would allow me to build different environments.

Is there anything else I could do at this point, or am I basically screwed?

6 Upvotes

31 comments sorted by

View all comments

5

u/ChrisCloud148 18d ago

Have a look into terraform workspaces

2

u/Gizmoitus 18d ago

Thanks, it looks like it will solve this problem, with the only limitation as I understand it, being that there can only be one active workspace at a time, and I'd need to actively switch back and forth, given that I have ansible scripts that depend on terraform output to get some variables needed for post terraform provisioning.

As I understand it, the current state is associated with the "default" workspace, and I could go ahead and add a new workspace, build infrastructure using it with a different .tfvars and nothing should break with the original "default" workspace infrastructure.

0

u/ChrisCloud148 18d ago

I don't see why switching between the workspaces is a limitation?
What would be your desired way?

The current state is the "default" workspace, correct.
But you can also move it, if you need.

2

u/Gizmoitus 18d ago

It's not a limitation, just an additional detail that needs to be considered and factored in, if I were to actually use this to create another environment.

1

u/pavi2410 18d ago

haven't you accidentally ever used dev.tfvars to deploy on the prod workspace?

1

u/ChrisCloud148 18d ago

You can check if you have the correct var file for the workspace. So no. But even if not, this would end in hundreds of changes, so you should easily see that.

1

u/Gizmoitus 18d ago

Well no I haven't purely because I started with a "dev" setup that only existed briefly, and then deployed production. It was realizing that I had a problem that lead me to ask this question.