Terraform Workshop – Overview · Terraform

Overview

This workshop covers the path from infrastructure-as-code fundamentals to HCP Terraform, Terraform Enterprise, policy as code, state security and incident response.

The focus is on:

Terraform language and HCL
providers, resources, data sources, variables, locals and outputs
CLI workflow with init, fmt, validate, plan, apply and destroy
state, backends, locking, workspaces and remote state
modules, versioning, registry models and refactoring
CI/CD, plan artifacts, HCP Terraform, Terraform Enterprise and TACOS
security, secrets, supply chain, policy as code and recovery

Quickstart

# Workshop content is provided through the Orthevs Academy.
chmod +x scripts/provision_terraform.sh
./scripts/provision_terraform.sh --dry-run
./examples/00-lab-skeleton/run.sh

Audience

Developers, DevOps engineers, system engineers, platform engineers, SREs, cloud engineers, tech leads and security engineers who write, review, automate or secure Terraform configurations.

Learning Path

Level	Focus	Outcome
Fundamentals	IaC, HCL, Provider, Resources, Variablen, Outputs, lokaler State und sicherer CLI-Workflow	You can explain, locally check and review the related Terraform patterns.
Intermediate	Module, Backends, Remote State, Locking, for_each, lifecycle, Import und Refactoring	You can explain, locally check and review the related Terraform patterns.
Professional	Multi-Environment-Design, Modulversionierung, CI/CD, Drift, HCP Terraform, TACOS und Governance	You can explain, locally check and review the related Terraform patterns.
Advanced Security	State Security, Least Privilege, Supply Chain, Policy as Code, Destroy-Schutz und Incident Response	You can explain, locally check and review the related Terraform patterns.

Structure

Workshop Structure

.
├── assessments/
├── docs/
├── examples/
├── exercises/
├── media/
├── scripts/
├── workshops/
├── LICENSE.md
└── README-EN.md

Prerequisites

Linux, macOS or WSL
Terraform CLI for real CLI labs
Git
Python 3 for local validation scripts
optional HCP Terraform or Terraform Enterprise for remote-run and governance labs

Official Documentation

Working Mode

Do not use production cloud credentials in labs.
State files and plan artifacts are treated as sensitive data.
Examples use local artifacts and simulated review models.
License, platform and ecosystem decisions are documented instead of assumed.

Sources and References

Review Checklist for the Workshop

01. document configuration and target state: Record the affected module, provider, resource, state and backend path.
02. review provider requirement: Record the affected module, provider, resource, state and backend path.
03. explain state impact: Record the affected module, provider, resource, state and backend path.
04. evaluate plan diff: Record the affected module, provider, resource, state and backend path.
05. describe backend and locking model: Record the affected module, provider, resource, state and backend path.
06. review module boundary: Record the affected module, provider, resource, state and backend path.
07. evaluate variable and output: Record the affected module, provider, resource, state and backend path.
08. produce drift evidence: Record the affected module, provider, resource, state and backend path.
09. mark secret risk: Record the affected module, provider, resource, state and backend path.
10. name policy or CI gate: Record the affected module, provider, resource, state and backend path.
11. record rollback or recovery path: Record the affected module, provider, resource, state and backend path.
12. write team rule: Record the affected module, provider, resource, state and backend path.
13. document configuration and target state: Record the affected module, provider, resource, state and backend path.
14. review provider requirement: Record the affected module, provider, resource, state and backend path.
15. explain state impact: Record the affected module, provider, resource, state and backend path.
16. evaluate plan diff: Record the affected module, provider, resource, state and backend path.
17. describe backend and locking model: Record the affected module, provider, resource, state and backend path.
18. review module boundary: Record the affected module, provider, resource, state and backend path.
19. evaluate variable and output: Record the affected module, provider, resource, state and backend path.
20. produce drift evidence: Record the affected module, provider, resource, state and backend path.
21. mark secret risk: Record the affected module, provider, resource, state and backend path.
22. name policy or CI gate: Record the affected module, provider, resource, state and backend path.
23. record rollback or recovery path: Record the affected module, provider, resource, state and backend path.
24. write team rule: Record the affected module, provider, resource, state and backend path.
25. document configuration and target state: Record the affected module, provider, resource, state and backend path.
26. review provider requirement: Record the affected module, provider, resource, state and backend path.
27. explain state impact: Record the affected module, provider, resource, state and backend path.
28. evaluate plan diff: Record the affected module, provider, resource, state and backend path.
29. describe backend and locking model: Record the affected module, provider, resource, state and backend path.
30. review module boundary: Record the affected module, provider, resource, state and backend path.
31. evaluate variable and output: Record the affected module, provider, resource, state and backend path.
32. produce drift evidence: Record the affected module, provider, resource, state and backend path.
33. mark secret risk: Record the affected module, provider, resource, state and backend path.
34. name policy or CI gate: Record the affected module, provider, resource, state and backend path.
35. record rollback or recovery path: Record the affected module, provider, resource, state and backend path.
36. write team rule: Record the affected module, provider, resource, state and backend path.

Practice Appendix: Workshop

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with HCL artifacts and a Git repository.

A001. Terraform

Task: document configuration and target state and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A002. HCL

Task: review provider requirement and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A003. State

Task: explain state impact and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A004. Backend

Task: evaluate plan diff and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A005. Security

Task: describe backend and locking model and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A006. Terraform

Task: review module boundary and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A007. HCL

Task: evaluate variable and output and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A008. State

Task: produce drift evidence and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A009. Backend

Task: mark secret risk and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A010. Security

Task: name policy or CI gate and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A011. Terraform

Task: record rollback or recovery path and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A012. HCL

Task: write team rule and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A013. State

Task: document configuration and target state and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A014. Backend

Task: review provider requirement and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A015. Security

Task: explain state impact and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A016. Terraform

Task: evaluate plan diff and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A017. HCL

Task: describe backend and locking model and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A018. State

Task: review module boundary and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A019. Backend

Task: evaluate variable and output and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A020. Security

Task: produce drift evidence and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A021. Terraform

Task: mark secret risk and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A022. HCL

Task: name policy or CI gate and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A023. State

Task: record rollback or recovery path and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A024. Backend

Task: write team rule and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A025. Security

Task: document configuration and target state and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A026. Terraform

Task: review provider requirement and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A027. HCL

Task: explain state impact and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A028. State

Task: evaluate plan diff and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A029. Backend

Task: describe backend and locking model and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A030. Security

Task: review module boundary and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A031. Terraform

Task: evaluate variable and output and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A032. HCL

Task: produce drift evidence and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A033. State

Task: mark secret risk and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A034. Backend

Task: name policy or CI gate and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A035. Security

Task: record rollback or recovery path and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A036. Terraform

Task: write team rule and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A037. HCL

Task: document configuration and target state and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A038. State

Task: review provider requirement and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A039. Backend

Task: explain state impact and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A040. Security

Task: evaluate plan diff and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A041. Terraform

Task: describe backend and locking model and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A042. HCL

Task: review module boundary and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A043. State

Task: evaluate variable and output and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A044. Backend

Task: produce drift evidence and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A045. Security

Task: mark secret risk and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A046. Terraform

Task: name policy or CI gate and connect the observation explicitly to Terraform.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A047. HCL

Task: record rollback or recovery path and connect the observation explicitly to HCL.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A048. State

Task: write team rule and connect the observation explicitly to State.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A049. Backend

Task: document configuration and target state and connect the observation explicitly to Backend.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.

A050. Security

Task: review provider requirement and connect the observation explicitly to Security.
Evidence: Record at least one Terraform-related command, expected output and a boundary of that evidence.
Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Describe whether revert, state operation, import, backend restore, secret rotation or manual provider correction would be needed.