TerraformのlocalバックエンドでCI/CDが詰まる構造｜backend切替の設計判断軸

この記事のポイント

・terraform backend localはCI環境でステートが毎回リセットされリソース重複作成が起きる
・ローカルファイルロックは別マシン・別コンテナには効かず並行apply時にstate競合が発生する
・AWS環境ならS3＋DynamoDB組み合わせが最小構成のリモートバックエンド定番
・localが許容できるのは個人学習・使い捨て試験環境のみ。チーム利用・CI導入時は即切替が必要

# backend未指定 = 暗黙的にlocalバックエンドが選ばれる
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# 明示的に書く場合（デフォルトと同じ動作）
terraform {
  backend "local" {
    path = "terraform.tfstate"
  }
}

$ ls -la
total 32
drwxr-xr-x  3 ec2-user ec2-user 4096 Sep 28 09:00 .
drwxr-xr-x 10 ec2-user ec2-user 4096 Sep 28 08:55 ..
drwxr-xr-x  3 ec2-user ec2-user 4096 Sep 28 09:00 .terraform
-rw-r--r--  1 ec2-user ec2-user  197 Sep 28 09:00 .terraform.lock.hcl
-rw-r--r--  1 ec2-user ec2-user  234 Sep 28 08:55 main.tf
-rw-r--r--  1 ec2-user ec2-user 4521 Sep 28 09:02 terraform.tfstate

$ terraform plan

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami                          = "ami-0c02fb55956c7d316"
      + instance_type                = "t3.micro"
      + id                           = (known after apply)
      + private_ip                   = (known after apply)
      + public_ip                    = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

$ terraform apply

Acquiring state lock. This may take a few moments...
╷
│ Error: Error acquiring the state lock
│
│ Error message: ConditionalCheckFailedException:
│                The conditional request failed
│ Lock Info:
│   ID:        d2c7a9b1-3f4e-41a2-85c8-1b2d3e4f5a01
│   Path:      s3://my-tf-state/prod/terraform.tfstate
│   Operation: OperationTypeApply
│   Who:       alice@alice-workstation
│   Version:   1.9.5
│   Created:   2026-09-28 09:12:34.123456789 +0000 UTC
│
│ Terraform acquires a state lock to protect the state from being written
│ by multiple users at the same time.
╵

# .gitignoreに必ず追加すること（localバックエンド使用時）
# リモートバックエンドに切り替えれば手元にtfstateは生成されない

.terraform/
terraform.tfstate
terraform.tfstate.backup
*.tfvars
*.tfvars.json
override.tf
override.tf.json

# S3バケット作成（バケット名はグローバルで一意）
$ aws s3api create-bucket     --bucket my-terraform-state-20260928     --region ap-northeast-1     --create-bucket-configuration LocationConstraint=ap-northeast-1
{
    "Location": "http://my-terraform-state-20260928.s3.amazonaws.com/"
}

# バージョニング有効化（applyミス後のstate復旧に必須）
$ aws s3api put-bucket-versioning     --bucket my-terraform-state-20260928     --versioning-configuration Status=Enabled

# DynamoDBテーブル作成（パーティションキーはLockIDが必須）
$ aws dynamodb create-table     --table-name terraform-lock     --attribute-definitions AttributeName=LockID,AttributeType=S     --key-schema AttributeName=LockID,KeyType=HASH     --billing-mode PAY_PER_REQUEST     --region ap-northeast-1
{
    "TableDescription": {
        "TableName": "terraform-lock",
        "TableStatus": "CREATING"
    }
}

terraform {
  backend "s3" {
    bucket         = "my-terraform-state-20260928"
    key            = "prod/terraform.tfstate"
    region         = "ap-northeast-1"
    dynamodb_table = "terraform-lock"
    encrypt        = true
  }
}

$ terraform init -migrate-state

Initializing the backend...
Do you want to copy existing state to the new backend?
  Pre-existing state was found while migrating the previous "local" backend to the
  newly configured "s3" backend. No existing state was found in the newly configured
  "s3" backend. Do you want to copy this state to the new "s3" backend?
  Enter "yes" to copy and "no" to start with an empty state.

  Enter a value: yes

Successfully configured the backend "s3"!
Terraform has been successfully initialized!

terraform {
  backend "gcs" {
    bucket  = "my-terraform-state-bucket"
    prefix  = "prod/terraform/state"
  }
}

# バケット作成
$ gsutil mb -l asia-northeast1 gs://my-terraform-state-bucket
Creating gs://my-terraform-state-bucket/...

# バージョニング有効化
$ gsutil versioning set on gs://my-terraform-state-bucket
Enabling versioning for gs://my-terraform-state-bucket/...

$ terraform init
╷
│ Error: Backend configuration changed
│
│ A change in the backend configuration has been detected, which may require
│ migrating existing state.
│
│ If you wish to attempt automatic migration of the state, use "terraform
│ init -migrate-state".
│ If you wish to store the current configuration with no changes to the
│ state, use "terraform init -reconfigure".
╵

# 最小限必要なIAMポリシー（S3+DynamoDB用）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-terraform-state-20260928",
        "arn:aws:s3:::my-terraform-state-20260928/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": "arn:aws:dynamodb:ap-northeast-1:123456789012:table/terraform-lock"
    }
  ]
}