Promotion Without Copy-Paste

Scenario: A team copies a dev state file into production to 'promote' infrastructure and accidentally transfers resource identities.

Promote immutable module or configuration versions, never state. Each environment owns distinct state and remote objects. CI can plan the same reviewed module release against stage, collect evidence, then update production's pinned version. Environment values belong in explicit tfvars, variable sets, or root configuration, while policy determines who may approve each stage.

Analogy: You promote a recipe version from test kitchen to restaurant; you do not move the test kitchen's inventory ledger into the restaurant.

A worked configuration

module "service" {
  source  = "app.terraform.io/platform/service/fakecloud"
  version = "4.3.1" # promoted artifact
  env     = "prod"
}

State lineage protects against some mistaken uploads, but process is the real guardrail. Separate backend credentials, apply identities, and approvals so a development pipeline cannot mutate production even if misconfigured.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-saved-plan-replacement Terraform lab. Open /labs/terraform and choose slug tf-saved-plan-replacement; the lab runs real Terraform against the offline FakeCloud provider.