State locking with DynamoDB in Terraform - Step-by-Step Execution

Process Flow - State locking with DynamoDB

Terraform Init

↓

Check DynamoDB Lock Table

↓

Try to Acquire Lock

↓

Release Lock

↓

Complete

Terraform uses a DynamoDB table to lock the state file during operations. It tries to acquire a lock before applying changes, waits if locked, then releases the lock after completion.

Execution Sample

Terraform

terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "state.tfstate"
    region = "us-east-1"
    dynamodb_table = "terraform-lock"
  }
}

This Terraform backend configuration enables state locking using a DynamoDB table named 'terraform-lock'.

Process Table

Step	Action	DynamoDB Lock Table State	Lock Acquired?	Terraform Behavior
1	Terraform Init starts	Empty (no lock)	No	Attempts to acquire lock
2	Acquire lock request sent	Empty (no lock)	Yes	Lock acquired, proceed
3	Terraform applies changes	Lock held by current operation	Yes	Apply changes to infrastructure
4	Terraform finishes apply	Lock held by current operation	Yes	Releases lock
5	Lock released	Empty (no lock)	No	Operation complete
6	Another Terraform run starts	Empty (no lock)	No	Attempts to acquire lock
7	Acquire lock request sent	Lock held by another operation	No	Waits and retries until lock free

💡 Terraform stops waiting when the lock is released and it successfully acquires the lock.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	After Step 7
Lock Status	Unlocked	Locked by current run	Locked by current run	Locked by current run	Unlocked	Locked by another run

Key Moments - 3 Insights

Why does Terraform wait before applying changes sometimes?

Terraform waits because the DynamoDB lock table shows the state is locked by another operation (see execution_table row 7). It retries until the lock is released.

What happens if Terraform does not release the lock?

If Terraform does not release the lock (see execution_table row 4), other runs will be blocked indefinitely, causing delays and potential errors.

How does Terraform know the lock is free?

Terraform checks the DynamoDB lock table state (execution_table column 'DynamoDB Lock Table State'). When it is empty, Terraform can acquire the lock and proceed.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does Terraform first acquire the lock?

A Step 3

B Step 1

C Step 2

D Step 5

💡 Hint

Check the 'Lock Acquired?' column in execution_table row 2.

According to variable_tracker, what is the lock status after Step 5?

A Locked by current run

B Unlocked

C Locked by another run

D Unknown

💡 Hint

Look at the 'Lock Status' variable value after Step 5 in variable_tracker.

If the lock is held by another operation, what does Terraform do according to the execution_table?

A Waits and retries to acquire the lock

B Proceeds with apply anyway

C Fails immediately

D Deletes the existing lock

💡 Hint

See the 'Terraform Behavior' column at Step 7 in execution_table.

Concept Snapshot

Terraform state locking with DynamoDB:
- Uses a DynamoDB table to lock state during operations
- Acquires lock before applying changes
- Waits if lock is held by another run
- Releases lock after apply completes
- Prevents concurrent state modifications

Full Transcript

Terraform uses a DynamoDB table to lock the state file during infrastructure changes. When Terraform starts, it tries to acquire a lock by writing to the DynamoDB table. If the lock is free, Terraform proceeds to apply changes. If the lock is held by another operation, Terraform waits and retries until the lock is released. After finishing, Terraform releases the lock so others can proceed. This prevents multiple Terraform runs from changing the state at the same time, avoiding conflicts and corruption.