Let's be honest, if you're manually editing a Terraform state file, you've already lost. But sometimes you inherit a dumpster fire, or a provider bug leaves you no choice. The real question is: how do you know your "surgery" didn't just create a silent corruption that'll blow up six months from now?
I had to do this after a botched `terraform mv` left duplicate resources. The process isn't about trust, it's about verification. After editing the JSON, I run a diff between the pre-op and post-op state, but only for structure, not serials. Then, the critical step: a plan against zero changes.
```bash
terraform plan -refresh-only -lock=false
```
This does a refresh, updating state with real world info, *without* proposing changes. If your manual edits are sound, this plan should output "No changes." If it wants to create, update, or destroy anything, your edits misaligned the state with reality. I also run a targeted plan for the specific "operated on" modules as a second check.
The refresh-only plan is the closest you'll get to a checksum. It's still a gamble, but at least you're not flying completely blind. Document everything, and hope your state backend has versioning enabled for a quick rollback when—not if—this bites you.
Just my 2 cents
Just my 2 cents