Terraform "Failed to load state: ConditionalCheckFailed" (Digest Mismatch) in CI
The S3 backend stores a checksum of the state in DynamoDB and verifies it on read. The recorded digest no longer matches the S3 object - usually because a previous write was interrupted between S3 and DynamoDB.
What this error means
A state read fails with a ConditionalCheckFailed/digest-mismatch error, complaining the state in S3 does not match the checksum recorded in DynamoDB. It follows a killed apply that updated one store but not the other.
Error: Failed to load state: state data in S3 does not have the expected
content.
This may be caused by unusually long delays in S3 processing a previous state
update. Please wait for a minute or two and try again...
operation error DynamoDB: the conditional request failed (ConditionalCheckFailedException)Common causes
Interrupted write between S3 and DynamoDB
A cancelled apply or terminated runner can update the S3 state object but not the DynamoDB digest (or vice versa), so the verification on the next read fails.
S3 eventual-consistency delay (rare)
In rare cases a brief delay in S3 reflecting a recent write makes the digest temporarily disagree; this clears on its own after a minute.
How to fix it
Wait and retry first
If the cause was a brief delay, retrying after a minute resolves it with no manual change.
sleep 60
terraform plan -input=falseReconcile the recorded digest with the real state
- Confirm no apply is running and back up the current S3 state object.
- Verify which store is correct (the latest S3 object is normally authoritative).
- Update or remove the stale digest item in the DynamoDB lock table so it matches the real S3 state, then re-run.
How to prevent it
- Avoid cancelling applies mid-write so S3 and DynamoDB stay consistent.
- Enable S3 versioning so a prior good state object can be recovered.
- Serialize Terraform jobs to reduce interrupted concurrent writes.