Finding
The Terraform state backend is a single-region, single-bucket SPOF (single point of failure) with no S3 Object Lock, no MFA-delete, and no cross-region replication. This gap is already author-acknowledged in docs/improvements/001.
Why it matters (failure scenario)
A regional S3 outage, an accidental bucket deletion, or a compromised role with DeleteObject rights (see the state-isolation finding above) can destroy the org's only copy of Terraform state with no recovery path — turning a recoverable incident into a full manual-reconstruction event for every managed account.
Evidence
docs/improvements/001 — author-acknowledged gap, not yet actioned.- No Object Lock / MFA-delete / CRR config found in the state bucket Terraform.
Recommended fix (major change)
Enable S3 Object Lock (compliance or governance mode) on the state bucket, add cross-region replication (CRR) to a second region, and deny DeleteObject/PutBucketVersioning suspension without MFA present (aws:MultiFactorAuthPresent condition) — the AWS-canonical durable-state-backend pattern for org-critical Terraform state.
Part of #312.
Finding
The Terraform state backend is a single-region, single-bucket SPOF (single point of failure) with no S3 Object Lock, no MFA-delete, and no cross-region replication. This gap is already author-acknowledged in
docs/improvements/001.Why it matters (failure scenario)
A regional S3 outage, an accidental bucket deletion, or a compromised role with
DeleteObjectrights (see the state-isolation finding above) can destroy the org's only copy of Terraform state with no recovery path — turning a recoverable incident into a full manual-reconstruction event for every managed account.Evidence
docs/improvements/001— author-acknowledged gap, not yet actioned.Recommended fix (major change)
Enable S3 Object Lock (compliance or governance mode) on the state bucket, add cross-region replication (CRR) to a second region, and deny
DeleteObject/PutBucketVersioningsuspension without MFA present (aws:MultiFactorAuthPresentcondition) — the AWS-canonical durable-state-backend pattern for org-critical Terraform state.Part of #312.