Terraform lineage is a UUID stored in state to identify one state instance. Terraform creates it when terraform init first creates state, and it remains unchanged for that project. section 6.3.3 section 6.3.1
Backends compare lineage values before accepting state updates. A mismatch indicates that Terraform may be using state from another project or environment, helping prevent a cross-environment overwrite. section 6.3.3 section 6.3
Reading lineage alongside serial
A state JSON object might contain "serial": 6 and "lineage": "7490ef49-8634-ac56-596b-6f2f4259bece". The lineage identifies the state instance; the serial identifies its iteration. When restoring a backup, use lineage to confirm the project and serial to distinguish the newer state version. section 6.3.3 section 6.3.1
Listing 6.3 Terraform state as JSON
{
"version": 4, #1
"terraform_version": "1.5.4", #2
"serial": 6, #3
"lineage": "7490ef49-8634-ac56-596b-6f2f4259bece", #4
"outputs": { #5
"password": {
"value": "[-Cz\u003em@XQnZc",
"type": "string",
"sensitive": true
}
},
"resources": [ #6
{
"module": "module.my_password",
"mode": "data",
"type": "null_data_source",
"name": "values",
"provider": "provider[\"registry.terraform.io/hashicorp/null\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"has_computed_default": "default",
"id": "static",
"inputs": null,
"outputs": null,
"random": "1249756966943803081"
},
"sensitive_attributes": []
}
]
},
{
"module": "module.my_password",
"mode": "managed",
"type": "random_password",
"name": "new_password",
"provider": "provider[\"registry.terraform.io/hashicorp/random\"]",
"instances": [
{
"schema_version": 3,
"attributes": {
"bcrypt_hash": "$2a$10$DxQHHtRQY9.I.vGpLGLjV..
c9pbvfh2vFDax0OFRag1TN4Om44t0.",
"id": "none",
"keepers": null,
"length": 12,
"lower": true,
"min_lower": 0,
"min_numeric": 0,
"min_special": 0,
"min_upper": 0,
"number": true,
"numeric": true,
"override_special": null,
"result": "[-Cz\u003em@XQnZc", #7
"special": true,
"upper": true
},
"sensitive_attributes": [] #8
}
]
}
],
"check_results": [ #9
{
"object_kind": "check",
"config_addr": "module.my_password.check.password_strength",
"status": "pass",
"objects": [
{
"object_addr": "module.my_password.check.password_strength",
"status": "pass"
}
]
}
]
}
#1 This version is for the state data structure itself.
#2 This is the version of Terraform that generated this file.
#3 The serial is the version of the file itself. This is the sixth state file version for the project.
#4 The lineage is a UUID created when the project is initialized for the first time. The lineage should never change.
#5 Outputs are from the root-level module. The output from our child module is not included.
#6 Every resource and data source in the project will have an associated object here.
#7 This value was generated by the resource itself.
#8 In theory, the result should have been flagged, but the sensitive_attributes field does not appear to be used anymore.
#9 Results from check block are stored in state.
Inspect the complete state JSON structure, including the lineage and serial fields beside Terraform version, outputs, and resources. section 6.3.1
Treat lineage as state metadata rather than a value to edit manually. For operational inspection, terraform state pull exposes it; terraform show omits lineage and serial, so tooling may need to combine both outputs. section 6.3 section 11.1.6
