How does Terraform state work, and how do you manage it across a team?

State is Terraform's record of which real resources correspond to which configuration addresses, plus cached attributes it uses to compute a plan. For a team it has to live in a remote backend with locking, such as S3 with native lockfile support or a managed backend, so two applies cannot run at once. Never commit it to git, since it holds secrets in plain text, and split it by blast radius rather than keeping one giant file.

State is the map between what I wrote in code and what actually exists in the provider, keyed by resource address, plus a cache of attributes so a plan does not have to read everything from scratch. On a team it goes in a remote backend with locking, so two people running apply at the same time cannot corrupt it. The thing that surprises people is that state contains resource attributes verbatim, so database passwords and generated keys sit in there in plain text; that means the bucket is encrypted, versioned, and locked down to the pipeline role, not readable by everyone. On layout, I split by blast radius and by change rate. Networking and accounts change rarely and get their own state, each service or environment gets its own, and they read from each other through data sources or published outputs rather than one root module holding everything. The practical reason is a five hundred resource state file makes every plan slow and every mistake enormous. For recovery I rely on bucket versioning plus state mv and import rather than editing the file by hand.