criticalProductionSymptom-first#state#destroy#import#recovery

State file gone — everything shows as new

terraform plan shows everything will be created (no existing resources in state)

Likely source:data-losssecurity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • terraform plan shows everything will be created (no existing resources in state)
  • Plan output shows +N to add, 0 to change, 0 to destroy for all resources
  • State file deleted or never existed for existing infrastructure

If state is truly gone and no remote backend exists, you must import every resource manually. This is why remote backends with versioning are mandatory.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Plan showing all creates

    terraform plan 2>&1 | tail -5
  • State list empty

    terraform state list

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • terraform state list returns empty
  • terraform.tfstate is missing or empty

Confirm before fixing

ls -la terraform.tfstate*
READ

Check if state file exists

Fix

terraform state pull > terraform.tfstate
CHANGE

Pull state from remote backend

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
terraform state list
READ

Confirm the state is empty

2
terraform state pull > terraform.tfstate
CHANGE

Try to recover from remote backend

3
terraform import <RESOURCE-ADDR> <CLOUD-ID>
CHANGE

Import existing resources one by one if state is truly gone

4
terraform plan
READ

Verify all resources are now tracked

Prevention

  • Always use remote backends with versioning enabled.
  • Never store state locally in production.
  • Run terraform state pull weekly and verify the resource count.
  • Use terraform cloud or Spacelift for state management with audit trails.

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.