How should Terraform state be split across environments and infrastructure layers?

Separate states per environment and stack have worked well for us. A stack should represent a coherent unit with clear ownership and a manageable change scope. This makes reviews and selective applies safer, especially when an urgent or previously unreviewed change needs to be isolated.

Separating layers can make plans faster and reduce state-lock contention when multiple teams work at the same time. It also helps when different parts of the platform need different execution environments—for example, public runners handling initial networking while private runners create resources inside a private cluster. Just avoid creating so many tiny states that ordinary changes become cumbersome.

A useful rule is to keep resources together when they’re provisioned and removed together. Otherwise, split state around failure domains, ownership, and how frequently components change. Networking, clusters, and databases are often good candidates for separate states so routine application changes don’t risk critical infrastructure.

There isn’t one universal layout. A structure like dev/landing-zone, dev/app1, and dev/app2 can work well when each stack has clear ownership and a limited blast radius. Organizing by application or use case is often more practical than organizing strictly by resource type.