Terraform state ownership and shared dependencies

Terraform state ownership and shared dependencies An architecture diagram generated by Archify. 01-network · VPC · subnets · NAT Gateway · Architecture component · network 01-network VPC · subnets · NAT Gateway network 02-cluster · EKS Auto Mode · admin access · Architecture component · cluster 02-cluster EKS Auto Mode · admin access cluster 03-platform · Optional add-ons · ESO access · Architecture component · platform 03-platform Optional add-ons · ESO access platform Terraform state (S3) · Distinct keys by environment, layer, and color · Architecture component Terraform state (S3) Distinct keys by environment, layer, and color outputs outputs Legend Database Cloud

Ownership

  • • Network owns VPC, subnets, routes, and endpoints
  • • Cluster owns EKS and administrator access
  • • Platform owns optional mixed-node DNS, ESO identity, and team access

Dependency impact

  • • Separate state limits the configuration scope of each plan
  • • VPC, DNS, and IAM failures can still affect dependent layers
  • • Frequency and apply duration depend on the environment

State controls

  • • Choose distinct backend bucket/key values and matching initialization directories
  • • Native S3 locking needs use_lockfile=true and lock-object permissions
  • • State version recovery does not roll back AWS resources