Use remote backend (S3 + DynamoDB) for Terraform state and locking. Each environment gets its own prefix based on ID.