How to fix state blob is already locked in Terraform

First, verify that no other Terraform operations are currently running against this state file:

# Check your local machine for any running terraform processes
ps aux | grep terraform

# Check Azure Portal for the state blob lease status
# Navigate to Storage Account > Containers > [your-container] > terraform.tfstate
# Look at the 'Leased state' column

If another operation is running locally, wait for it to complete. If it's in a CI/CD pipeline, check your pipeline dashboard to see if a previous run is stuck.

If no active operation is running but the state remains locked:

1. Go to the Azure Portal
2. Navigate to your Storage Account
3. Select Containers
4. Open the container holding your state file (usually tfstate or similar)
5. Click on the terraform.tfstate blob
6. In the Overview panel, find the 'Lease state' field showing 'Leased'
7. Click the 'Break lease' button
8. Wait for the status to change to 'Broken'
9. Retry your Terraform operation

Alternatively, use the Azure CLI to break the lease programmatically:

az storage blob lease break \
  -b terraform.tfstate \
  -c tfstate \
  --account-name "mystorageaccount" \
  --account-key "your-storage-key"

Replace:
- mystorageaccount with your storage account name
- tfstate with your container name
- Use --connection-string instead of --account-key if you prefer

If breaking the lease doesn't work, use Terraform's force-unlock command. First, identify the lock ID from your error message or by checking recent logs:

terraform force-unlock <LOCK_ID>

The lock ID should be visible in your Terraform error output. Use this only as a last resort since it bypasses safety checks. Be absolutely certain no other operations are using the state file before forcing an unlock.

To prevent this error in the future, add lock timeout and retry flags to your Terraform commands:

terraform init -backend-config="..." -lock=true -lock-timeout=120s
terraform plan -lock=true -lock-timeout=120s
terraform apply -lock=true -lock-timeout=120s

This allows Terraform to retry acquiring the lock for up to 120 seconds instead of failing immediately. Adjust the timeout based on your typical operation duration.

The root cause prevention requires ensuring only one pipeline can run against a state file at a time. Implement one of these approaches:

GitHub Actions:

concurrency:
  group: terraform-${{ github.ref }}
  cancel-in-progress: false

GitLab CI:

resource_group: terraform

Azure DevOps:
- Use a pipeline resource lock or manual approval gate
- Enable 'Use the auto-injected checkout task' and set concurrency settings

These prevent multiple pipeline runs from executing Terraform simultaneously on the same state.