# State and drift

Terraform stores both permanent roots in the `stormtrust-tfstate` Cloudflare R2 bucket. Each root uses a separate state key and provider credential.

## State keys

| Root       | R2 key                        |
| ---------- | ----------------------------- |
| GitHub     | stormtrust/github.tfstate     |
| Cloudflare | stormtrust/cloudflare.tfstate |

Terraform uses native S3 lock files. Every post-merge apply verifies the state object, managed resource addresses, state serial, and absence of a stale lock.

## Drift detection

The scheduled drift workflow plans each root independently. A detected change updates the issue for that root. A clean plan closes the active drift issue.

Caution

Do not edit the R2 state object or lock directly. Follow the [R2 backend recovery procedure](https://github.com/StormTrust/infrastructure/blob/main/org/cloudflare/r2-backend-recovery.md) for break-glass recovery.