Terraform Remote State on an S3 Backend — Frankfurt

Classically the AWS S3 backend needed a separate DynamoDB table (dynamodb_table) as the lock — without it, two concurrent runs could destroy the state. Since Terraform 1.10 and OpenTofu 1.8 there is use_lockfile = true: before any writing run the backend creates a .tflock object right next to the state file — via conditional S3 writes (If-None-Match) that let exactly one writer win. No second service, no extra bill, no additional IAM policy for DynamoDB. intercolo i3 supports these conditional writes, so the lock works cleanly for your whole team. One backend block, done — the second apply waits or fails with a lock error instead of overwriting the state.

If you already use the AWS S3 backend, migration is a minimal diff: in your existing backend "s3" block set region = "de-fra", add endpoints = { s3 = "https://de-fra.i3storage.com" } plus the three skip_ flags and use_lockfile = true — and remove the old dynamodb_table line. Point AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY at your intercolo SigV4 keys. A terraform init -migrate-state copies the state from AWS into the Frankfurt bucket. Your resources, modules and providers stay untouched — only the state moves house. To confirm, terraform plan then shows no changes.