State and drift

Terraform stores both permanent roots in the stormtrust-tfstate Cloudflare R2 bucket. Each root uses a separate state key and provider credential.

Terraform uses native S3 lock files. Every post-merge apply verifies the state object, managed resource addresses, state serial, and absence of a stale lock.

The scheduled drift workflow plans each root independently. A detected change updates the issue for that root. A clean plan closes the active drift issue.