An infrastructure state file records the current state of deployed infrastructure, such as cloud instances, networks, permissions, and resource IDs. Tools like Terraform use it to compare desired configuration with what actually exists and to plan changes safely. Because it can map relationships between systems and sometimes store outputs or embedded secrets, it is more sensitive than it looks.
In cyber security, exposed state files are valuable to attackers because they can reveal cloud account details, internal endpoints, credential material, and the layout of an environment. Defenders should keep these files out of web roots, restrict access, encrypt backends where supported, and avoid storing secrets inside state. Treat state as privileged data: if a dev server, bucket, or repository exposes it, an attacker may use it to move from information gathering to direct access.