TL;DR: For most teams an object-store backend (S3 or the cloud equivalent) with locking, versioning on, and per-prefix IAM roles wins on operational burden. Managed platforms buy workspace RBAC, policy gates, and PR automation under the vendor's pricing model. Self-hosted supported backends add operational work; historical backend names must be checked against the selected CLI version.
How to approach it
Name the requirements before the products: durable versioned state, exclusive locking, per-stack access control, CI-friendly authentication, a repair story at 2am. Then make one recommendation with reversal conditions instead of presenting a menu.
A strong answer
Any backend worth deploying must guarantee five things: state survives operator error (versioning with recoverable history), two applies cannot interleave (locking), one team can be denied another team's state (scoped credentials), CI authenticates without long-lived keys, and whoever is on call can repair a corrupted or stuck lock. Score the candidates against that list:
| Backend | Locking | Rollback story | Per-stack access | Ops burden |
|---|---|---|---|---|
| S3 (+ native lock) | Conditional write | Bucket versioning | Prefix-scoped IAM roles | Low |
| GCS / Azure Blob | Native | Object versioning | Prefix-scoped IAM | Low |
| Managed platform (HCP Terraform and peers) | Built in | Run history plus snapshots | Workspace-level RBAC | Vendor-dependent pricing and operating effort |
| Self-hosted Consul (where supported) | Backend lease | You build and rehearse it | Coarse | High |
The object store is the default call. For sixty to a hundred state roots across 40 engineers, S3 with bucket versioning can have low storage costs, but price request volume, logging, encryption and retained versions; current Terraform versions lock natively through S3 conditional writes (the DynamoDB lock table was the old requirement), and per-component access reduces to one IAM role per pipeline scoped to a prefix. The failure modes are well understood and the repair path, restoring a prior object version, is something you rehearse rather than improvise.
Managed platforms earn their price when governance grows teeth. Workspace-level RBAC, policy enforcement before apply, PR automation, and run history behind a UI are real value for regulated estates or platform teams serving dozens of squads. Costs depend on the vendor's resource, run or other billing measures, plus routing state and run telemetry through a vendor, and adopting their workflow conventions. Migration between backends is cheap (terraform init -migrate-state), so starting on S3 and moving up later is reversible; so is the trip back down when licensing gets renegotiated.
Check backend support before choosing a self-hosted option. Consul has a supported backend in applicable Terraform versions; etcd is a historical backend removed from modern Terraform. Choosing one today means owning lease semantics, backups, and upgrades for capabilities object stores ship by default.
Whichever wins, the non-negotiables stay constant: versioning on, encryption enforced, access logged, and applies only from CI identities so there is exactly one place to look when a lock misbehaves.
What interviewers probe next
"Why did S3 ever need DynamoDB?" Object stores lacked compare-and-swap, so an external lock table supplied atomicity. Conditional writes closed that gap in recent releases; older setups still carry the table.
"Does backend choice fix secrets sitting in state?" No. Encryption and ACLs narrow who reads state, but the values remain readable to anyone inside that circle, so secret handling stays a separate discipline from backend selection.
"How do you split one giant state into per-team roots?" Fresh roots per component, resources transferred using a supported state migration procedure or import plus deliberate removal from the old state. moved blocks remap addresses within a state, not between separate states, executed behind a maintenance window with the old state kept read-only for a month.
Common mistakes
Choosing a managed platform for three engineers, paying vendor licensing for features a bucket already provides.
Local state on a shared runner "just for this sprint", discovered months later as the only copy of production truth.
Skipping versioning, then meeting a corrupted state with no recovery point and learning the lesson permanently.
Sources: Moving resources between state files.