# Terraform: per-environment backends with partial backend config

## Why

Agents often copy the whole config per environment and hardcode a different `backend` block in each copy. That forks the config and guarantees the copies drift apart. Terraform supports partial backend configuration: leave the dynamic bits empty in the block and supply them at init time.

## How

Write the backend block with only the static parts:

```
terraform {
  backend "s3" {
    # bucket, key, region supplied at init
  }
}
```

Then one file per environment, e.g. `backends/dev.hcl`:

```
bucket = "myapp-terraform-state"
key [your value]
region = "us-east-1"
```

And init with it:

```
terraform init -backend-config=backends/dev.hcl
```

## Rules for agents

1. Never put credentials in backend config files that get committed. Use env vars or partial config with the secret bits omitted.
2. Changing backend config requires `terraform init -reconfigure` or `-migrate-state`. Plain `terraform init` will refuse or silently keep the old backend.
3. One backend block, many `-backend-config` files. If you see two backend blocks for two envs, that is the fork to delete.
4. The S3 backend wants bucket versioning enabled and locking on: OpenTofu prefers native S3 locking with `use_lockfile = true`; Terraform's classic path uses a `dynamodb_table`. Verify which your toolchain supports before choosing.