Terraform State
Buckets
Canonical env-dataops service roots use a state bucket named:
fetch-terraform-state-<account-id>The current prod account-level root is an exception: terraform/accounts/prod-dataops/backend.tf still points at the legacy data-platform-857967394368/state/infra/account/prod-dataops.tfstate backend. Treat the table below as the target convention for new env-dataops state and for sub-prod account roots, not as proof that every historical account root has already moved.
Key Conventions
| Root Type | Key Shape | Example |
|---|---|---|
| Service root | <service>/us-east-1/terraform.tfstate | kyuubi/us-east-1/terraform.tfstate |
| Account root | accounts/<env>-dataops/data-platform/us-east-1/terraform.tfstate | accounts/stage-dataops/data-platform/us-east-1/terraform.tfstate |
Backend Migration Pattern
For existing production state, use this order:
- Verify a no-op plan on the current backend.
- Back up the state object in S3.
- Download a local state backup and inspect it.
- Copy the state object to the new backend key.
- Switch backend/provider code.
- Run a protected no-op plan.
- Run a protected no-op apply.
- Run runtime smoke tests after the backend migration.
Checked Against
implementations/2026-05-21-dl-419-prod-dataops-runtime-progress.md.implementations/2026-05-26-dl-388-terraform-cutover-progress.md.terraform/accounts/*/backend.tfonorigin/main, including the current prod account-root legacy backend exception.