MidIaC & Automation

Why do teams use remote state with locking instead of local state?

What they are really testing: Whether you understand that local state is not shareable and has no locking, so a team needs a shared backend with locking to avoid concurrent applies corrupting state.

A real interview question

Why do teams use remote state with locking instead of local state?

What most people say

drag me

Remote state lets the team access the state from anywhere.

Access is part of it but the critical reason is locking, without it, two concurrent applies corrupt the state, plus durability, encryption, and not losing state on a laptop. The corruption-prevention angle is the key point.

The follow-ups they ask next

  • What specifically goes wrong without state locking?

    Two concurrent applies (two people, or a person and CI) write to the state at the same time and interleave, corrupting it, leaving Terraform confused about what exists. Locking serializes applies so only one runs at a time.

  • What does a remote backend give you beyond sharing?

    Locking (no concurrent-apply corruption), encryption at rest, access control, and versioning/backups for recovery, plus durability (not lost with a laptop). It becomes the single secured source of truth.

What the interviewer is listening for

  • Knows local state is unshareable/loseable
  • Centers on locking to prevent corruption
  • Mentions durability/encryption/versioning

What sinks the answer

  • Only "access from anywhere"
  • No mention of locking
  • Would keep state local for a team

If you genuinely do not know

Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.

Local state [lives on one machine, unshareable, easily lost, leaks secrets if committed]. A [remote backend (S3/Terraform Cloud/GCS) stores one shared, durable, encrypted copy]. Critically, [state locking serializes applies, without it two concurrent applies corrupt the state (S3+DynamoDB or native lockfile)]. Plus [encryption, access control, versioning/backups]. So no real team uses local state.

Keep going with iac & automation

All 336 cloud engineer questions

Knowing the answer is not the same as recalling it under pressure

Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.

Start free