Moving Terraform state locking from DynamoDB to S3 native locking with use_lockfile
Terraform's S3 backend can lock state with a lock file in the bucket itself, and DynamoDB-based locking is deprecated. How S3 native locking works, the IAM it needs, a safe migration with both mechanisms on during the transition, and the failure modes we tested.