Should I commit Terraform State files to the git repository

Question

Should I commit the state files of terraform i.e the .tfstate files to the repository. The terraform docs on its website says:

---

Terraform also put some state into the terraform.tfstate file by default. This state file is extremely important; it maps various resource metadata to actual resource IDs so that Terraform knows what it is managing. This file must be saved and distributed to anyone who might run Terraform. We recommend simply putting it into version control, since it generally isn't too large.

---

But one of the most upvoted answer on the best practices thread of terraform says that these .tfstate files should be stored in a centralized location like S3 but not in a GIT Repository.

Can anyone tell what practice should I follow

Answer 1

Here's why you shouldn't store your terraform state files in your version control repository like git:

- At times, if your colleague is working on the same terraform files you both may end up overwriting each others changes on the .tfstate files. On the other hand you may forget to commit your changes after working on terraform which in turn will result in your colleagues having an out dated .tfstate file.

- Another reason for not storing .tfstate files on git is that these files are not encrypted at all. There may be some instance when you have to use passwords while integrating with terraform. Terraform stores these in plain text in the .tfstate files.

Update:

Terraform has updated their documentation:

---

Terraform also puts some state into the terraform.tfstate file by default. This state file is extremely important; it maps various resource metadata to actual resource IDs so that Terraform knows what it is managing. This file must be saved and distributed to anyone who might run Terraform. It is generally recommended to setup remote state when working with Terraform. This will mean that any potential secrets stored in the state file, will not be checked into version control

---

Answer 2

Its better not to commit it to git because of the following reasons:

1) You might have forgotten to commit or push a few changes after running terraform apply and your team mates will have outdated information and then they'll work on those outdated codes, creating chaos.

2) The .tfstate files may contain secrets. These secrets may contain passwords and other critical information which will just be stored as a plain text file, there's no encryption.

3) Without any locking on these state files, if two team members run Terraform at the same time on the same .tfstate files, you may overwrite each other's changes.