Terraform state locking prevents concurrent apply race conditions

Two terraform apply runs executing simultaneously against the same state file corrupt the state. One apply reads stale state, both write conflicting changes, and infrastructure drifts from the declared configuration.

Use a backend that supports state locking. For S3 + DynamoDB:

terraform {
  backend "s3" {
    bucket         = "my-tfstate-bucket"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

DynamoDB table must have LockID as the partition key (String type).

In CI, use terraform plan + apply in sequence with the -lock-timeout flag:

- run: terraform plan -lock-timeout=10m -out=tfplan
- run: terraform apply -lock-timeout=10m tfplan

DynamoDB provides conditional writes with atomic lock acquisition. If a lock exists, the second apply waits or fails rather than proceeding with stale state.