One state file for everything, and a change to a DNS record blocked by a lock held by a network apply.
the split, by change frequency:
network/ VPC, subnets, security groups.
changed 4 times in 4 years.
data/ databases, buckets. monthly.
app/ compute, DNS, certificates. weekly.
and the dependency, one direction only: app reads
network's outputs through a remote state data source.
what it cost: three days, and a fortnight of getting
the apply order wrong.The apply order is the ongoing cost and it is not enforced by anything — a change spanning two states is two applies in sequence, and getting it backwards produces a plan referencing an output that does not exist yet. Doing this in 2021 would have been an afternoon; doing it with four years of accumulated resources was three days, which is the usual ratio.