Is it possible to store your state for different Terraform Workspaces separately?

Question

Let's say I have a terraform project with a production and development workspace. Is it possible to store the development workspace elsewhere so I don't have to give the admin the ability to run commands that mess up production?

I'm basing this question on the "Terraform: Up & Running, 2nd Edition" book by Yevgeniy Brikman which calls this a "drawback". From Page 93,

The state files for all of your workspaces are stored in the same backend (e.g., the same S3 bucket). That means you use the same authentication and access controls for all the workspaces, which is one major reason workspaces are an unsuitable mechanism for isolating environments (e.g., isolating staging from production).

Are there any tools to help address this following with the above quote, is there anyway to store the state for different workspaces in different S3 buckets? Or, is the only option to forgo Terraform workspaces entirely.

Answer 1

This is possible and I just completed a migration at my company. We originally had all our state for all workspaces in a centralized s3 bucket.

We now have a separate s3 bucket per workspace, and in our case each workspace is tied directly to an aws account.

To do this you have to pass in back end settings dynamically at the time of terraform init. We do this in a centralized pipeline template so it is handled for the developers automatically and it goes to the correct location.

Here is the docs on how to pass in these settings at the time of terraform init.

https://www.terraform.io/language/settings/backends/configuration#command-line-key-value-pairs

Let me know if you have any questions on this.