Migrate a pipeline

If your pipeline keeps state as a tar.gz bundle in a bucket, it has no lock, and the bundle is replaced whole. You can move the state to Firstlume first and keep the pipeline running as it is. The runs can move later.

Steps

1. Create the stack in Firstlume, pointing at the environment's folder.
2. Stop the pipeline's applies. Import the current bundle with dry_run=true and check the units and the prefix. Then import for real.
3. Replace the root.hcl with the snippet from State backend, and create the state tokens: one read token for the plan and one write token for the apply.
4. In the pipeline, export FIRSTLUME_STATE_URL and TF_HTTP_PASSWORD, and remove the steps that download and upload the bundle.
5. Check: terragrunt run --all -- plan -lock=false must report "No changes" on every unit. Keep the old bundle for a while, read-only.

Why the bundle goes away

• Each unit writes its own version when its apply finishes, so a failure in one unit no longer leaves the others out of the state.
• Locks are per unit, so two applies can't overwrite each other.
• Every write becomes an encrypted version.