state-file-s3-step-by-step

provider "aws" {
  region = "ap-south-1"
}

resource "aws_s3_bucket" "terraform_state" {
  bucket = "networknuts-terraform-state-file"
 
  # Prevent accidental deletion of this S3 bucket
  lifecycle {
    prevent_destroy = true
  }
}

#enabling versioning on bucket

resource "aws_s3_bucket_versioning" "enabled" {
  bucket = aws_s3_bucket.terraform_state.id
  versioning_configuration {
    status = "Enabled"
  }
}

#enabling encryption

resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

#no one is allowed to make it public and block acl

resource "aws_s3_bucket_public_access_block" "public_access" {
  bucket                  = aws_s3_bucket.terraform_state.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}


# create dynamodb table for locking

resource "aws_dynamodb_table" "terraform_locks" {
  name         = "networknuts-terraform-state-file-locks"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }
}


## now run - terraform init

## configure terraform to use s3 for state file - vim terrform.tf

terraform {
  backend "s3" {
    # Replace this with your bucket name!
    bucket         = "networknuts-terraform-state-file"
    key            = "global/s3/terraform.tfstate"
    region         = "ap-south-1"

    # Replace this with your DynamoDB table name!
    dynamodb_table = "networknuts-terraform-state-file-locks"
    encrypt        = true
  }
}


## run - terraform init

## to check the state file pushing to s3 create
## these output variables

output "s3_bucket_arn" {
  value       = aws_s3_bucket.terraform_state.arn
  description = "The ARN of the S3 bucket"
}

output "dynamodb_table_name" {
  value       = aws_dynamodb_table.terraform_locks.name
  description = "The name of the DynamoDB table"
}

###

#### Partial backends
## create a file - vim backend.hcl

bucket         = "networknuts-terraform-state-file"
region         = "ap-south-1"
dynamodb_table = "networknuts-terraform-state-file-locks"
encrypt        = true

## file ends

# now change the terraform.tf to this

terraform {
  backend "s3" {}
  
}

## run 


terraform init -backend-config=backend.hcl