# Terraform state recovery

## Containment
- [ ] Automated and manual applies are paused
- [ ] Workspace, backend, account and region are confirmed
- [ ] Current incident owner and recovery approver are recorded
- [ ] No lock is removed until the active writer is disproved

## Preserve evidence
- [ ] Backend version, state serial and lineage are recorded
- [ ] Current state is pulled to an access-controlled location
- [ ] Backup hash and storage location are recorded
- [ ] Configuration commit and provider lock file are preserved

## Reconcile identity
- [ ] Real resource identifiers are verified through the provider
- [ ] Configuration addresses are compared with state addresses
- [ ] Missing, duplicate and stale bindings are listed explicitly
- [ ] Dependencies and moved blocks are reviewed

## Recovery decision
- [ ] Restore, import, move, remove or provider replacement is justified
- [ ] The least invasive operation has been selected
- [ ] Every command has an expected state change and rollback path
- [ ] A second reviewer approves destructive or lineage-changing work

## Validation
- [ ] State can be read through the normal backend path
- [ ] A fresh plan contains no unexplained create, replace or destroy actions
- [ ] Critical resource attributes match the live provider state
- [ ] Backend locking and versioning protections are restored

## Return to service
- [ ] Recovery evidence and final state version are retained
- [ ] Automation resumes under a named owner
- [ ] A final plan confirms convergence
- [ ] Follow-up prevention work has an owner and due date