Everything Terraform state can't do.
Terraform stores your state as a JSON file behind a global lock. Stategraph stores it as a normalized graph in PostgreSQL. Same HCL, same modules, same providers. That one change underneath is where every feature on this page comes from.
Teams running Terraform on Stategraph
The difference underneath
It's the storage layer, not the syntax
Slow plans, lock contention, fragile cross-state wiring, and a state you cannot query all trace back to one decision: state is a file. Put it in a database and each of those problems stops existing.
Terraform and OpenTofu
terraform planLoads and refreshes every resource, every timeWork grows with the state, not the changeCross-state reads see only the last apply. There is no query, no history, and no graph, so every question is a grep and every split is more wiring.
Stategraph
stategraph planSized to the slice your change touchesLocks are per resource. Cross-state plans see pending changes. SQL, an audit timeline, blast radius, and cost are queries over the same graph your applies write to.
terraform plan: 3+ hoursMeasured on real states. Single benchmarks; results vary with state shape.
Cross-state plans
Producer and consumer in one plan
Change a producer module and its consumer updates in the same plan. Terraform's terraform_remote_state only ever reads the last applied state, so you apply the producer first and hope. Stategraph plans both states together and commits them in one transaction.
Real output. One plan updates rm1 and rm2 together.
Features
What the graph makes possible
Grouped by what changes for you. Each one links to a page with the details.
Faster plan and apply
Work proportional to the change
Terraform loads and refreshes the whole state on every plan. Stategraph reads only the slice a change can reach, so plan time stops growing with the estate.
Parallel applies
Locks the size of the change
One lock on the file means one change at a time. Stategraph locks the resources a change touches, plans across states together, and commits them as one transaction.
Resource-level locking
Two engineers on the same state, on different resources, never block each other.
Multi-state transactions
Changes spanning many root modules plan and apply as one transaction. All or nothing.
Cross-state plans
Change a producer and its consumers update in the same plan. No apply-first ordering.
Queryable state
Every question is a query
State is rows and edges in PostgreSQL, so inventory, blast radius, history, and cost are questions you ask the graph. Nothing is exported and nothing syncs on a schedule.
SQL inventory
Query every resource across every state with SQL. No export pipeline, no second source of truth.
Blast radius
Every resource a change reaches, with dependency distance, before you apply.
Audit timeline
An immutable, queryable log of who changed what and when.
Cost preview
A current-versus-planned monthly cost delta under every plan.
Cost attribution
Spend across every state by provider, type, or tag, checked against your actual bill.
Gap analysis
Cloud resources no state manages, with generated import blocks. AWS and GCP.
Safe changes
Change without the terror
Every plan reports the security findings a change would add and resolve. A refactor computes its own state moves, so nothing is destroyed and recreated by accident. A token carries exactly the capabilities it needs, on exactly the resources it may touch.
Security scanning
States are scanned with Checkov on the server. stategraph plan prints the findings a change would add and resolve, right under the diff, and tenant posture is tracked day by day.
Safe refactoring
Restructure your HCL. Stategraph computes the state moves and writes the moved blocks.
Access control
Tokens scoped to capabilities on specific resources, states, or tenants.
AI agents
Scope the key, not the prompt
"Only plan, never apply" in a system prompt is a suggestion a model can ignore. Stategraph puts the boundary in the credential: an agent gets a token that can plan but not apply, limited to the resources it is working on. Skill files teach the agent the workflows and the safe defaults.
Scoped agent tokens
Plan and apply are separate grants, each limited to a state or an address pattern inside one. The worst a confused model can do is a wrong plan.
Agent skills
SKILL.md workflows for query, cost, change, import, and refactor. A router picks the right one from the request.
Compatibility
Same HCL. New substrate.
Stategraph sits underneath Terraform and OpenTofu. Keep writing the HCL you already write while state lives in a database. The compatibility reference maps Terraform's surface area command by command, including what the transaction model makes unnecessary.
Terraform compatibility reference →Command for command
| terraform plan | → | stategraph plan |
| terraform apply | → | stategraph apply |
| terraform import | → | stategraph import tf |
| terraform state mv | → | stategraph refactor |
| terraform output | → | stategraph query |
| terraform workspace select | → | stategraph states resolve |
| terraform force-unlock | → | stategraph tx abort |
| backend "s3" { ... } | → | stategraph.json |
See it on your own state
Import an existing Terraform state and watch plans get faster, locks get smaller, and your infrastructure become queryable.