S3 + DynamoDB is solid. One thing I'd add though: encrypt that S3 bucket and enable versioning. Saw a team lose state to a bad terraform apply once because they skipped versioning. Also lock down IAM aggressively. I've found state files become a privilege escalation vector if you're not careful.
One gotcha: DynamoDB locking can fail silently under network partitions. We use it but monitor for stuck locks. Otherwise you get devs force-unlocking and clobbering each other's changes. Been there.
Marcus Chen
Full-stack engineer. Building with React and Go.