Terraform Workspace State Mismatch: How to Fix Wrong Environment Deploys

# You think you're in dev, but plan shows production resources
terraform plan
# ...shows destroying prod RDS instances you didn't expect
 
# Or workspace shows wrong resources
terraform show | grep environment
# Shows "production" when you expected "development"
 
# State file references wrong backend
terraform state list | head -20
# Shows resources with prod-* prefix when you're supposedly in dev workspace

# Current workspace
terraform workspace show
 
# List all workspaces
terraform workspace list
# Output:
#   default
# * dev           <- currently selected (marked with *)
#   staging
#   production

# List all resources in current state
terraform state list
 
# Count resources per environment prefix
terraform state list | grep -c "^module.vpc"
 
# Get details of a specific resource
terraform state show aws_db_instance.main
 
# Should show values matching your current workspace (e.g., instance type, tags)

# Switch to correct workspace
terraform workspace select staging
 
# Verify
terraform workspace show  # should show: staging
 
# Now re-run plan to confirm
terraform plan

# backend.tf
terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "env/${terraform.workspace}/terraform.tfstate"
    region = "us-east-1"
  }
}

# Check what state is currently stored in S3
aws s3 ls s3://my-terraform-state/env/dev/
aws s3 ls s3://my-terraform-state/env/production/
 
# Download and inspect state file
aws s3 cp s3://my-terraform-state/env/dev/terraform.tfstate ./dev-state.json
cat dev-state.json | jq '.resources[0].instances[0].attributes.tags'
# Check if tags say environment = "dev" or environment = "production"

# First, create a backup of both states
terraform state pull > backup-current-state.json
 
# Move a resource from current state to another workspace's state
# (Terraform doesn't support cross-workspace state moves directly)
# Instead: use state mv with a combined approach
 
# Step 1: Remove from wrong workspace
terraform workspace select dev
terraform state rm aws_db_instance.main
 
# Step 2: Switch to correct workspace
terraform workspace select production
 
# Step 3: Import the resource into correct state
terraform import aws_db_instance.main db-abcd1234efgh
 
# Step 4: Verify
terraform plan  # should show 0 changes if import was correct

# variables.tf
locals {
  env = terraform.workspace
  
  config = {
    dev = {
      instance_type = "t3.micro"
      min_capacity  = 1
      max_capacity  = 2
      db_class      = "db.t3.micro"
    }
    staging = {
      instance_type = "t3.small"
      min_capacity  = 1
      max_capacity  = 3
      db_class      = "db.t3.small"
    }
    production = {
      instance_type = "t3.large"
      min_capacity  = 2
      max_capacity  = 10
      db_class      = "db.r6g.large"
    }
  }
  
  current = local.config[local.env]
}

#!/bin/bash
# deploy.sh - called from CI/CD
set -euo pipefail
 
EXPECTED_ENV="${1:-}"
CURRENT_WORKSPACE=$(terraform workspace show)
 
if [ "$CURRENT_WORKSPACE" != "$EXPECTED_ENV" ]; then
  echo "ERROR: Expected workspace '$EXPECTED_ENV' but current is '$CURRENT_WORKSPACE'"
  echo "Run: terraform workspace select $EXPECTED_ENV"
  exit 1
fi
 
echo "Workspace verified: $CURRENT_WORKSPACE"
terraform plan -out=tfplan

- name: Verify workspace before apply
  run: |
    WORKSPACE=$(terraform workspace show)
    if [ "$WORKSPACE" != "${{ inputs.environment }}" ]; then
      echo "Wrong workspace! Expected ${{ inputs.environment }}, got $WORKSPACE"
      exit 1
    fi
  working-directory: ./infrastructure