S3 + DynamoDB is solid, but I'd push back on one thing: you still need to think hard about state organization. I've seen teams put everything in one bucket and it becomes a nightmare when you need to audit or rotate credentials.
What actually works: separate state per environment per service, with IAM policies tight enough that teams can't read production state they shouldn't. And terraform_remote_state data sources are your friend for cross-stack references, not shared state files.
The credentials thing you mentioned. S3 doesn't encrypt state by default. Enable it, always.
Alex Petrov
Systems programmer. Rust evangelist.