How do you manage Terraform state across a team, and what do you do about drift?

Use remote state with locking, such as S3 plus DynamoDB or a managed backend, split into one state file per environment and blast radius, and never commit state to git since it stores secrets in plain text. For drift, run plan on a schedule and alert on any non empty diff, keep all changes flowing through CI rather than the console, and use import or removed blocks deliberately instead of hand editing state.

Remote backend with locking, always, so two applies cannot race. Beyond that the big decision is how you split it. One giant state file means a plan takes fifteen minutes and every change risks everything, so I split per environment and then per blast radius: networking separate from the cluster, the cluster separate from application resources, and shared data pulled in with remote state outputs or data sources rather than a monolith. State also contains secrets in plain text, which people forget, so it lives in an encrypted bucket with tight IAM and versioning on. For drift, I run terraform plan nightly in CI and alert if the diff is non empty. That found a security group someone had widened by hand during an incident, which is exactly the case you want to catch. I do not ban console access in emergencies, but the rule is that you open a pull request the same day to codify whatever you did, and the nightly plan is what enforces it.