Interview › Infrastructure as Code (Terraform, Ansible)
How does Terraform use DynamoDB for state locking with an S3 backend?
Infrastructure as Code (Terraform, Ansible) · Basic level
Answer
Historically, Terraform's S3 backend used a DynamoDB table with a LockID partition key to acquire a lock before modifying state and release it afterward. That prevents concurrent writers. However, current Terraform S3 backend documentation marks DynamoDB-based locking as deprecated in favor of S3 lockfile locking, so I would migrate new work to use_lockfile where possible.
Technical explanation
Legacy DynamoDB locking uses a table row keyed by LockID; Terraform writes the lock and removes it when done.
If a run crashes, you may need force-unlock using the lock ID, but only after confirming no active writer exists.
For new Terraform S3 backends, check current support for use_lockfile and plan a migration away from DynamoDB-based locking.
Keep Terraform's ownership boundary clear: one state should own a resource or field, and other tools should consume published outputs instead of modifying it.
Use fmt, validate, linting, policy checks, plan review, and state locking before production applies.
Design for small blast radius by splitting state around lifecycle, permissions, and recovery boundaries.
Hands-on example
1. Implement remote state and locking for: How does Terraform use DynamoDB for state locking with an S3 backend?
2. Create or use an S3 bucket with versioning, encryption, public access blocked, and least-privilege IAM. Then configure the backend:
terraform {
backend "s3" {
bucket = "company-tfstate-prod"
key = "platform/network/prod.tfstate"
region = "ap-south-1"
encrypt = true
use_lockfile = true
}
}
3. For legacy DynamoDB locking, verify the table has partition key LockID and migrate deliberately because newer S3 locking makes DynamoDB locking deprecated.
4. Open two terminals and start two applies against the same state key; confirm the second run waits or fails on the lock instead of writing concurrently.
5. Recover safely by checking the active process first; only use force-unlock when the original run is definitely dead.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?