A Terraform lab is much easier to destroy and recreate when its state backend has a different lifecycle from the lab itself.

For my multi-cloud Zero Trust demo, the backend infrastructure lives in a separate project.

Backend project
  ├─ S3 state storage
  └─ DynamoDB coordination/locking
        ↓
Main demo state
        ↓
Disposable AWS/Azure/GCP/Cloudflare resources

That prevents a conceptual circular dependency where destroying the demonstration environment also destroys the platform used to manage its state.

It also gives the backend its own security, backup and retention decisions.

The main project can then be rebuilt repeatedly while the backend remains stable.

For learning environments in particular, destruction is part of the workflow, so separating persistent control-plane infrastructure from disposable workloads is worth doing early.

Related: Cloudflare Multi-Cloud Zero Trust Demo.