Add Terraform state management with S3 backend and DynamoDB locking

[FaveTeamz]

Summary

Configure Terraform remote state storage using an S3 backend with DynamoDB state locking to prevent concurrent apply operations from corrupting infrastructure state.

Background

Terraform state is currently managed locally, making it impossible for multiple team members to safely apply changes or run CI-based plans. Remote state with locking is a prerequisite for team collaboration and CI automation.

Requirements

• S3 bucket: workload-governor-tfstate with versioning enabled and public access blocked
• DynamoDB table: workload-governor-tfstate-lock with LockID primary key
• Backend configuration in terraform/main.tf using S3 backend
• Separate state files per environment (staging, production) using S3 key prefix
• State bucket encrypted with KMS key
• Bootstrap script to create the S3 bucket and DynamoDB table (chicken-and-egg problem)

Acceptance Criteria

• terraform init succeeds with S3 backend
• Concurrent terraform apply is blocked by DynamoDB lock
• State bucket has versioning and encryption enabled
• Bootstrap script documented and idempotent
• Staging and production use separate state files

References

• terraform/main.tf
• terraform/variables.tf

[Luchi5544]

@Luchi5544 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would love to work on this issue please assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Luchi5544 to this issue.

[BigMick03]

@BigMick03 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Good evening Maintainer,, I will like to work on this. Please assign.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @BigMick03 to this issue.

[Caneryy]

@Caneryy has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi there, can I work on this issue?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Caneryy to this issue.

[soterika]

@soterika has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

hello maintainer i will like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @soterika to this issue.

[drips-wave]

Congratulations, @soterika! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @soterika: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @soterika as part of the Stellar Wave Program's 7th Wave 🥳

😎 @soterika: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.