Terraform State and Environments

Dev, Test, and Prod state are isolated. Backends use encryption, locking, versioning, and least-privileged access. CI roles can access only the roots and environments they operate.

Do not use Terraform workspaces as the sole isolation boundary for materially different customer or production environments unless the design is reviewed. Explicit roots often provide clearer access and blast-radius control.

State changes occur through reviewed automation. Break-glass state operations are recorded, peer-reviewed where possible, backed up, and followed by a normal plan confirming consistency.