HashiCorp Certified: Terraform Associate free question 8 / 10 · Domain 6: Terraform state management
A pipeline reports that the state is locked, and an engineer decides to run terraform force-unlock. What does the State Locking page say the command requires, and why?
- The workspace name, so that the command unlocks every lock it contains.
- The unique lock ID, a nonce so that the unlock targets the correct lock.
- The backend credentials again, so that it can prove who took the lock.
- A terraform state pull first, so that it keeps a copy of the locked state.
Show the answer and explanation
Answer: B
Why this is correct
The State Locking page describes a force-unlock command for releasing a lock by hand. To protect you, the force-unlock command requires a unique lock ID, and Terraform will output this lock ID if unlocking fails. This lock ID acts as a nonce, ensuring that locks and unlocks target the correct lock: the command releases the lock identified by that ID, so a lock that another run takes later is a different lock. The rest of the page explains why a lock exists at all. If supported by your backend, Terraform will lock your state for all operations that could write state, which prevents others from acquiring the lock and potentially corrupting your state. If state locking fails, Terraform does not continue, which is why a lock that is never released blocks the operations that come after it. The page also lets you disable state locking for most commands with -lock=false, but does not recommend it.
Why the other options are wrong
"The backend credentials again, so that it can prove who took the lock." … The page names one thing that force-unlock requires to protect you: a unique lock ID, which Terraform outputs if unlocking fails.
"The workspace name, so that the command unlocks every lock it contains." … The page says the command requires a unique lock ID, which acts as a nonce, ensuring that locks and unlocks target the correct lock: one lock, not every lock in a workspace.
"A terraform state pull first, so that it keeps a copy of the locked state." … terraform state pull loads your remote state and outputs it to stdout. What force-unlock requires, the page says, is a unique lock ID, which Terraform outputs if unlocking fails.
force-unlock takes the lock ID
Terraform prints a lock ID when unlocking fails. force-unlock needs that ID, so it releases exactly that lock.