Let's say I have a terraform project with a production and development workspace. Is it possible to store the development workspace elsewhere so I don't have to give the admin the ability to run commands that mess up production?

I'm basing this question on the "Terraform: Up & Running, 2nd Edition" book by Yevgeniy Brikman which calls this a "drawback". From Page 93,

The state files for all of your workspaces are stored in the same backend (e.g., the same S3 bucket). That means you use the same authentication and access controls for all the workspaces, which is one major reason workspaces are an unsuitable mechanism for isolating environments (e.g., isolating staging from production).

Are there any tools to help address this following with the above quote, is there anyway to store the state for different workspaces in different S3 buckets? Or, is the only option to forgo Terraform workspaces entirely.

1 Answer 1


This is possible and I just completed a migration at my company. We originally had all our state for all workspaces in a centralized s3 bucket.

We now have a separate s3 bucket per workspace, and in our case each workspace is tied directly to an aws account.

To do this you have to pass in back end settings dynamically at the time of terraform init. We do this in a centralized pipeline template so it is handled for the developers automatically and it goes to the correct location.

Here is the docs on how to pass in these settings at the time of terraform init.


Let me know if you have any questions on this.

  • This is encouraging! Out of curiosity, do you still wind up with a subdirectory for each workspace (e.g. env:/stage and end:/prod) in the separate S3 buckets? Commented Nov 22, 2022 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.