Production checklist
Terraform production checklist: 5 checks before launch
5 checks for running Terraform in production: 3 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (3)
Use remote state with locking and encryption
Local state gets lost or overwritten by two people applying at once.
Check the config
A backend block stores state remotely with locking (for example S3 with use_lockfile, or HCP Terraform), and nobody keeps a local terraform.tfstate.
terraform { backend "s3" { bucket = "<state-bucket>" key = "prod/terraform.tfstate" region = "<region>" encrypt = true use_lockfile = true } }Treat state as a secret
State files contain database passwords and keys in plain text.
Verify from the command line
The state bucket is encrypted, versioned and readable only by the people and CI roles that run Terraform.
aws s3api get-bucket-encryption --bucket <state-bucket> aws s3api get-bucket-versioning --bucket <state-bucket>
Review the plan in CI before every apply
A reviewed plan file is exactly what gets applied; no surprise deletions.
Check the config
CI saves the plan and applies exactly that file after approval.
terraform plan -out=tfplan terraform apply tfplan
Good to have (2)
Commit
.terraform.lock.hclto pin provider versionsEvery run then uses the provider builds you tested.
Verify from the command line
The lock file is committed.
git ls-files .terraform.lock.hcl
Mark secret variables and outputs as
sensitiveKeeps them out of plan output and CI logs.
Verify from the command line
Variables and outputs that hold secrets are marked sensitive = true.
grep -rn "sensitive *= *true" --include=*.tf .
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.