Terraform state: locking, remote backends, and safety
Terraform stores a mapping from resource addresses to real cloud IDs in state. Default `terraform.tfstate` on disk breaks teams: conflicts and leaked secrets. Remote state in S3/GCS/Azure Blob with locking (DynamoDB table, GCS native, etc.) serializes applies. State is sensitive—treat backups like production data.