Read a backend block and get what it actually configures: whether state is locked, whether it is encrypted, and whether any value uses interpolation, which a backend can never do.
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Decode. Nothing leaves this tab.
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
Two concurrent applies overwrite each other, and nothing reports it until resources go missing
terraform {
backend "s3" {
bucket = "my-state"
key = "prod/terraform.tfstate"
region = "eu-west-1"
encrypt = true
}
}The backend is initialised before variables exist, so this can never work and the error names the variable
terraform {
backend "s3" {
bucket = var.state_bucket
key = "prod/terraform.tfstate"
}
}These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
The backend is initialised before variables, locals and data sources exist. This is not an ordering problem with a fix, the expression language is simply unavailable at that point.
Instead:Use partial configuration: omit the value and pass -backend-config at init, or a per-environment backend config file.
Two concurrent applies both read the same state and the second overwrites the first, leaving state that does not describe reality. Nothing reports it at the time.
Instead:Set use_lockfile = true, or dynamodb_table on older setups. Not optional once more than one person or pipeline runs apply.
sensitive controls terminal output only. The plaintext value is written to state regardless, so anyone who can read state can read every secret.
Instead:Restrict read access to state as tightly as you would to the secrets themselves, and enable encryption at rest.
That single fact explains the two hardest things about backend configuration: why variables do not work, and why the partial-config pattern exists.
The backend is set up before the expression language is available. So bucket = var.state_bucket does not fail because the variable is undefined, it fails because there is nothing to evaluate it with. There is no ordering fix and no workaround at the expression level, which is why people spend so long on it.
Leave the environment-specific values out of the block entirely and supply them at init: -backend-config=key=value repeated, or -backend-config=prod.hcl pointing at a file. An empty backend block is legal and deliberate. The cost is that reading the file tells you nothing about where state lives, so the backend config files need to be as carefully managed as the configuration.
Without a lock, two concurrent applies both read the same state and the second overwrites the first. The result is state that no longer describes reality, with resources Terraform has forgotten. It is silent until somebody notices resources nobody can destroy. On S3 that means use_lockfile for the current native locking, or dynamodb_table for the older approach; on a shared configuration one of them is not optional.
Marking a variable or output sensitive controls whether Terraform PRINTS it. It has no effect on state, where the plaintext value is written. Anybody who can read the state file can read every generated password, private key and token the configuration touches, so read access to state is equivalent to read access to all of them.
The cloud block is the HCP Terraform integration and it is a different execution model: state lives there and the plan and apply can run there too. Declaring both a cloud block and a backend block is an error rather than a precedence question.
Whether the bucket exists, whether the credentials work, or what is actually in state. It reads the block you paste, in your browser, and makes no API call. Any value whose name suggests a credential is shown as hidden rather than echoed back.