Terraform "force-unlock failed" / Lock ID does not match in CI

By Daniel Zoghalchali·Latchkey

force-unlock removes a stuck lock, but only when you pass the exact current lock ID and have permission to delete it. A mismatched ID or a missing permission makes the unlock itself fail.

What this error means

terraform force-unlock <ID> fails reporting the supplied lock ID does not match the existing lock, or that deleting the lock item was denied.

Error: Local state cannot be unlocked by another process

Lock ID "abc-123" does not match existing lock ID "9db590f1-3e2a-..."

# or, with DynamoDB:
Error: failed to delete lock: AccessDenied: dynamodb:DeleteItem

Common causes

Wrong lock ID

The ID passed to force-unlock is not the one currently held; the lock may have rotated.

No permission to delete the lock

The runner role lacks dynamodb:DeleteItem (or S3 delete for the lock object).

Lock already released

The original run finished and freed the lock before force-unlock ran.

How to fix it

Use the exact current lock ID

1. Re-run the failing command to read the current lock ID from the error.
2. Pass that exact ID to terraform force-unlock.
3. Confirm no run is actually active before unlocking.

terraform force-unlock 9db590f1-3e2a-...

Grant lock-delete permission

Ensure the role can delete the lock item in DynamoDB (or the lock object in S3).

How to prevent it

• Avoid manual unlocks by serializing runs per workspace.
• Grant dynamodb:DeleteItem on the lock table to the CI role.
• Read the live lock ID from a fresh command rather than copying a stale one.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation