How to fix Error locking state: Error acquiring the state lock: ConditionalCheckFailedException in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 155 views

This error occurs when Terraform cannot acquire a lock on your state file, typically due to a previous incomplete operation or concurrent access. It happens most often with S3 backends using DynamoDB for state locking.

Quick fix

Fixes ConditionalCheckFailedException

ps aux | grep terraform
  1. Verify no active Terraform processes are running
  2. Use terraform force-unlock with the Lock ID
  3. If force-unlock fails, check AWS IAM permissions
  4. Manually remove the lock from DynamoDB (if needed)
terraform — error
ps aux | grep terraform
Error locking state: Error acquiring the state lock: ConditionalCheckFailedException

What this error means

Terraform uses state locking to prevent multiple processes from modifying the state file simultaneously, which could cause corruption. The ConditionalCheckFailedException error indicates that the conditional check for acquiring a lock failed—usually because another process already holds the lock or a previous operation was interrupted before releasing it. This is commonly seen when using S3 backends with DynamoDB for state management, where Terraform attempts to write a new lock record under the condition that one doesn't already exist.

Typical symptoms

  • terraform plan or terraform apply commands fail immediately with the ConditionalCheckFailedException error
  • Error message includes a Lock ID (e.g., 49b6e22e-XXXX-XXXX-XXXX-3e3097cf95d4)
  • Other team members cannot run Terraform operations against the same state
  • The lock persists even after waiting a reasonable amount of time
  • CI/CD pipeline fails when attempting to apply infrastructure changes

Common causes

  1. A previous Terraform operation was interrupted or terminated before it could release the state lock (e.g., Ctrl+C, process kill, network timeout)
  2. Multiple Terraform operations are running concurrently against the same state file
  3. Network interruption during a Terraform operation left the lock in an orphaned state
  4. Incorrect AWS credentials or missing IAM permissions to release locks in DynamoDB
  5. A CI/CD pipeline crashed or timed out during a Terraform run without proper cleanup
  6. Using the wrong AWS profile that cannot access the DynamoDB lock table

How to fix "Error locking state: Error acquiring the state lock: ConditionalCheckFailedException"

1Verify no active Terraform processes are running

Before forcing an unlock, confirm that no Terraform operations are currently in progress. Check for hanging processes:

On Linux/Mac:

bash
ps aux | grep terraform

On Windows (PowerShell):

powershell
Get-Process terraform* -ErrorAction SilentlyContinue

If you find active processes, allow them to complete naturally. If they're hung, kill them only after confirming no one else is using Terraform:

bash
kill -9 <process_id>
2Use terraform force-unlock with the Lock ID

Terraform provides the Lock ID in the error message. Use this to force-unlock the state:

bash
terraform force-unlock <LOCK_ID>

Example:

bash
terraform force-unlock 49b6e22e-1234-5678-90ab-3e3097cf95d4

WARNING: Only force-unlock if you are absolutely certain no other process holds the lock. Forcing an unlock while another process is writing state will corrupt it.

3If force-unlock fails, check AWS IAM permissions

If you receive a permission error, verify your AWS IAM user has the required permissions for DynamoDB lock management:

json
{
  "Effect": "Allow",
  "Action": [
    "dynamodb:DescribeTable",
    "dynamodb:GetItem",
    "dynamodb:PutItem",
    "dynamodb:DeleteItem"
  ],
  "Resource": "arn:aws:dynamodb:*:*:table/terraform-locks"
}

Also ensure you have the correct S3 permissions for your state file:

json
{
  "Effect": "Allow",
  "Action": [
    "s3:GetObject",
    "s3:PutObject",
    "s3:DeleteObject"
  ],
  "Resource": "arn:aws:s3:::your-bucket/path/terraform.tfstate*"
}
4Manually remove the lock from DynamoDB (if needed)

If terraform force-unlock doesn't work, you can manually remove the lock from DynamoDB using the AWS CLI:

List current locks:

bash
aws dynamodb scan --table-name terraform-locks --region us-east-1

Delete a specific lock:

bash
aws dynamodb delete-item \
  --table-name terraform-locks \
  --key '{"LockID": {"S": "your-bucket/path/terraform.tfstate"}}' \
  --region us-east-1

Replace terraform-locks with your actual DynamoDB table name and update the S3 path accordingly.

5Retry your Terraform operation

After releasing the lock, retry your Terraform operation:

bash
terraform plan
terraform apply

Optionally, use a lock timeout to prevent this issue from repeating:

bash
terraform plan -lock-timeout=10m
terraform apply -lock-timeout=15m

This gives concurrent operations up to 10-15 minutes to complete before timing out.

Advanced notes

S3-Native State Locking (Terraform 1.11+): Starting with Terraform 1.11.0, S3-native state locking is generally available as a replacement for DynamoDB-based locking. If you're experiencing frequent lock issues with DynamoDB, consider migrating to S3-native locking by updating your backend configuration and removing the DynamoDB table. This eliminates an external dependency and simplifies lock management.

Lock Timeout Defaults: By default, Terraform waits 10 seconds to acquire a lock before failing. Increasing the -lock-timeout value (e.g., to 30s or 1m) can help with transient network issues or slow backends.

Production Safety: In production environments, always prefer terraform force-unlock over -lock=false. The latter bypasses locking entirely and risks concurrent state modifications. Only use -lock=false for emergency reads (e.g., terraform state list -lock=false).

Preventing Future Occurrences: Implement graceful shutdown handlers in CI/CD pipelines to ensure Terraform releases locks properly. Avoid using kill -9 for Terraform processes; instead, use SIGTERM to allow cleanup. Set reasonable timeouts in your CI/CD configuration (e.g., 30 minutes for apply operations) to catch hung processes early.

Frequently asked questions

What does "ConditionalCheckFailedException" mean?
Terraform uses state locking to prevent multiple processes from modifying the state file simultaneously, which could cause corruption. The ConditionalCheckFailedException error indicates that the conditional check for acquiring a lock failed—usually because another process already holds the lock or a previous operation was interrupted before releasing it. This is commonly seen when using S3 backends with DynamoDB for state management, where Terraform attempts to write a new lock record under the condition that one doesn't already exist.
How do I fix "ConditionalCheckFailedException"?
This error occurs when Terraform cannot acquire a lock on your state file, typically due to a previous incomplete operation or concurrent access. It happens most often with S3 backends using DynamoDB for state locking.
What causes "ConditionalCheckFailedException"?
A previous Terraform operation was interrupted or terminated before it could release the state lock (e.g., Ctrl+C, process kill, network timeout) Multiple Terraform operations are running concurrently against the same state file Network interruption during a Terraform operation left the lock in an orphaned state
Is the "ConditionalCheckFailedException" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading