Terraform State Storage

Terraform state is the single most sensitive artifact in an infrastructure-as-code workflow: it holds resource IDs, connection strings, and sometimes secrets in plaintext. The canonical remote backends — Terraform Cloud, or the s3 backend paired with a DynamoDB lock table — solve concurrency with state locking, but they also drag in their own setup: an IAM policy here, a DynamoDB table there, a workspace subscription somewhere else. files.link is not a drop-in replacement for those: it does not implement Terraform's HTTP-backend locking protocol, and we will not pretend it does.

What it is genuinely good at is being the durable, private, off-platform home for your state backups and point-in-time snapshots. A common pattern is to keep your live backend wherever locking lives, then push a timestamped copy of terraform.tfstate to files.link after every successful apply so you have an independent recovery point that survives a backend misconfiguration or an accidental terraform state rm.

The upload is three calls: POST /v1/files/{folderId} to mint a presigned URL, PUT the state JSON to that URL, then POST /v1/files/confirm-upload with the returned id. A post-apply hook makes it automatic:

ID=$(terraform output -raw run_id 2>/dev/null || date +%s)
UP=$(curl -s -H "Authorization: $FILESLINK_KEY" \
  -d '{"files":[{"name":"tfstate-'$ID'.json"}]}' \
  https://api.files.link/v1/files/$STATE_FOLDER)
URL=$(echo "$UP" | jq -r '.urls[0].url'); FID=$(echo "$UP" | jq -r '.urls[0].id')
curl -s -X PUT --data-binary @terraform.tfstate "$URL"
curl -s -H "Authorization: $FILESLINK_KEY" \
  -d '{"ids":["'$FID'"]}' https://api.files.link/v1/files/confirm-upload

Keep the state folder private so every snapshot is reachable only through a short-lived signed URL — state should never sit on a public link. Because each upload is its own object, you accumulate a clean, timestamped version history you can diff or roll back to, without standing up a second cloud account just for backups. Files are encrypted at rest. If you need first-class locking, keep that in Terraform Cloud or an S3+DynamoDB backend and treat files.link as the recovery layer beside it.