State is the map between your HCL and the real Google Cloud resources behind it. This chapter takes that map off the laptop and into a versioned, CMEK-encrypted GCS bucket — natively locked, with no separate lock table to run.
7 topics
Everything Terraform knows about what it manages lives in state — a JSON record mapping each resource in your config to the real GCP object it stands behind. Lose that map, corrupt it, or share it badly across a team, and the cleanest configuration in the world produces a plan that fights reality. This chapter is about state: what it is, what is inside it, and how to host it safely on Google Cloud.
The chapter follows the Hatch pipeline as it moves the hatch-pipeline-dev state from a local file into the hatch-tfstate GCS bucket. Along the way: why deleting a Console resource makes Terraform want to recreate it, why the state file is a tier-0 secret, how the GCS backend locks natively without the DynamoDB table AWS needs, when workspaces help and when a project per environment is the right boundary, and how to adopt and refactor existing infrastructure without destroying it.