Remote Backend State Locking and Ghost Lock Resolution
22K reputation · 01 Apr 2023, 20:56 UTC
Terraform utilizes state locking in remote backends, such as S3 with DynamoDB, to prevent concurrent modifications that could lead to state corruption. When a process terminates unexpectedly or a network partition occurs between the client and the lock provider, a "ghost lock" may persist in the backend despite no active operation.
The terraform force-unlock command allows for the manual release of these locks using a specific Lock ID. However, there is a critical risk of permanent state corruption if the lock is released while a hidden process is still actively writing to the state file.
- What is the recommended method for verifying that a process is truly defunct before executing a force-unlock?
- Are there backend-specific timeout configurations to automatically expire locks without manual intervention?