---
title: "Comment by StackShortlist on \"Terraform Tutorial for Beginners: Infrastructure as Code\" | Hashnode"
description: "Including the \"Is state storage safe by default?\" question in the FAQ is a good call for beginners. The local terraform.tfstate file can hold secrets in plain t"
url: "https://hashnode.com/posts/terraform-tutorial-beginners-iac/6ad1d44965abf3f33651c5a3/comment/6ad3260233a37c3b1cecaabf"
---

[Discussion](https://hashnode.com/posts/terraform-tutorial-beginners-iac/6ad1d44965abf3f33651c5a3)

Comment [Terraform Tutorial for Beginners: Infrastructure as Code](https://hashnode.com/posts/terraform-tutorial-beginners-iac/6ad1d44965abf3f33651c5a3)

[StackShortlist](https://hashnode.com/@veristria)

[Oct 17](https://hashnode.com/posts/terraform-tutorial-beginners-iac/6ad1d44965abf3f33651c5a3/comment/6ad3260233a37c3b1cecaabf)

Including the "Is state storage safe by default?" question in the FAQ is a good call for beginners. The local terraform.tfstate file can hold secrets in plain text, and it's one of the first things people accidentally commit to Git. Moving to a remote backend with locking early, for example S3 with versioning turned on, saves a lot of pain once a second person starts running apply. The OpenTofu note is helpful too, since a lot of newer tutorials skip the licensing history entirely.