S3 dynamo state locking deprecated (re-open #3834)

[scott-brady]

Expected Behavior

Requesting to re-open #3834

This was closed with a workaround but the workaround isn't going to work for us, so requesting this get resolved without the need for a workaround.

Thanks to @chrisdrobison for raising this originally. Copying their original issue details below.

---

Add support for using the new S3 locking state capability. This is documented here:

https://developer.hashicorp.com/terraform/language/backend/s3

Actual Behavior

Receiving the following warning when deploying using S3 and an associated DynamoDB locking state table:

│ Warning: Deprecated Parameter
│ 
│   with data.terraform_remote_state.cross-stack-reference-input-infra-services,
│   on cdk.tf.json line 44, in data.terraform_remote_state.cross-stack-reference-input-infra-services:
│   44:       }
│ 
│ The parameter "dynamodb_table" is deprecated. Use parameter "use_lockfile"
│ instead.
│ 
│ (and 2 more similar warnings elsewhere)

There doesn't appear to be support for setting this new property in CDKTF.

Steps to Reproduce

1. Configure a stack to use an S3 backend with a DynamoDB table for locking state

Versions

language: csharp
cdktf-cli: 0.21.0
node: v22.20.0
cdktf: 0.21.0
constructs: 10.4.2
jsii: 1.113.0
terraform: 1.13.3
arch: arm64
os: linux 6.14.0-1013-aws
dotnet: 9.0.305

Providers

Provider Name	Provider Version	CDKTF	Constraint	Package Name	Package Version
aws	6.12.0	^0.21.0		HashiCorp.Cdktf.Providers.Aws	21.10.0
helm	3.0.2	^0.21.0		HashiCorp.Cdktf.Providers.Helm	12.0.1
kubernetes	2.38.0	^0.21.0		HashiCorp.Cdktf.Providers.Kubernetes	12.1.0

Gist

No response

Possible Solutions

No response

Workarounds

No response

Anything Else?

No response

References

• S3 dynamo state locking deprecated #3834

Help Wanted

• I'm interested in contributing a fix myself

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[scott-brady]

For more context on why the workaround isn't going to work -

We create the S3BackendConfig in a shared library in order to centralise the S3 bucket and IAM role settings, then call a library method to create the config and pass it into an S3Backend constructor, e.g.:

var s3BackendConfig = config.DefineS3BackendConfig(StackTaxonomyPath);
if (s3BackendConfig != null)
{
    _ = new S3Backend(this, s3BackendConfig);
}

The above code is part of our templates and included in every repo. We could add the override per the workaround on #3834 as follows:

var s3BackendConfig = config.DefineS3BackendConfig(StackTaxonomyPath);
if (s3BackendConfig != null)
{
    var s3Backend = new S3Backend(this, s3BackendConfig);
    s3Backend.AddOverride("use_lockfile", true);
}

This would work but we would need to apply this to every repo. Then if/when resolved via a new UseLockfile property on S3BackendConfig, we would need to remove it from every repo as well.

Fixing this upstream would save us this overhead.