Force Unlock Stale State Lock
An organization uses Terraform with AWS S3 backend and DynamoDB for state locking. During a plan, you receive an error: 'Error acquiring the state lock'. The lock information in DynamoDB shows a lock from a previous session that crashed. What is the most appropriate next step?
Quick Answer
The correct answer is to run terraform force-unlock with the lock ID. This is the appropriate next step because when a Terraform process crashes while holding a state lock, the lock entry persists in DynamoDB as a stale lock, blocking all subsequent operations. The terraform force-unlock command is specifically designed to override this stale state lock by directly removing the lock item from the DynamoDB locking table, safely releasing the lock without risking state corruption. On the HashiCorp Terraform Associate TF-003 exam, this scenario tests your understanding of state locking mechanics and the recovery workflow for crashed processes—a common trap is attempting to manually delete the DynamoDB entry, which bypasses Terraform’s safety checks and can corrupt state. Remember the memory tip: “Force unlock, don’t force delete” to reinforce that the command-line tool, not the database console, is the correct recovery path.
⚠ Common exam trap
HashiCorp often tests the distinction between `terraform unlock` (a non-existent command) and `terraform force-unlock` (the actual command), trapping candidates who assume a generic 'unlock' verb exists without knowing the exact syntax.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run terraform force-unlock with the lock ID
When a Terraform process crashes while holding a state lock, the lock remains in DynamoDB and must be manually released. The `terraform force-unlock` command with the specific lock ID is the designed mechanism to override a stale lock, as it directly interacts with the DynamoDB locking table to remove the lock item. This is the safest and most appropriate method, as it ensures the lock is released in a controlled manner without risking state corruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run terraform unlock
Why it's wrong here
There is no terraform unlock command.
- ✓
Run terraform force-unlock with the lock ID
Why this is correct
This command releases the lock from the previous session.
- ✗
Wait for the lock to expire automatically
Why it's wrong here
Terraform locks do not expire automatically; they must be released manually.
- ✗
Delete the lock item from DynamoDB table directly
Why it's wrong here
While possible, it bypasses Terraform's safety checks and is not the recommended approach.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on TF-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer manages infrastructure with Terraform using an S3 backend with DynamoDB locking. During a `terraform apply`, the engineer's network connection drops. After reconnecting, they run `terraform plan` and get an error: "Error acquiring the state lock." The lock is from the previous session. The engineer has verified that no other operations are running. What is the appropriate next step to proceed?
medium- A.Delete the DynamoDB table and recreate it
- B.Wait 15 minutes for the lock to expire automatically
- ✓ C.Use `terraform force-unlock <lock_id>` to remove the stale lock
- D.Run `terraform init` to reset the backend connection
Why C: `terraform force-unlock` is the intended mechanism to manually remove a stale lock from the DynamoDB table when the process that held the lock has terminated abnormally. The engineer has confirmed no other operations are running, so the lock is orphaned and safe to remove. This command requires the specific lock ID, which is provided in the error message.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.