diff --git a/.gitignore b/.gitignore
index debc659..f3aeebd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,8 +32,9 @@ override.tf.json
 # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
 # example: *tfplan*
 
-# Ignore dynamically created clusters.tf
+# Ignore dynamically created *.tf files
 clusters.tf
+backend.tf
 
 # Ignore temporary vi files
 *.swp
diff --git a/terraform/locals.tf b/terraform/locals.tf
index c4e344c..69fd1d9 100644
--- a/terraform/locals.tf
+++ b/terraform/locals.tf
@@ -1,6 +1,10 @@
 # locals.tf - root module local variable definitions
 
 locals {
+  backends = {
+    for key in keys(var.backends):
+      key => var.backends[key] if var.backends[key].enabled == true
+  }
   clusters = {
     gke = {
       for key in keys(var.clusters):
diff --git a/terraform/main.tf b/terraform/main.tf
index 582db23..966c4be 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -1,167 +1,208 @@
 # main.tf - root module
 
-resource "local_file" "clusters" {
-  filename             = "${path.module}/clusters.tf"
-  file_permission      = "0664"
-  directory_permission = "0775"
-
-  content = <<-EOF
-  ### GKE ####
-  %{ for key in keys(local.clusters.gke) }
-  provider "google" {
-    alias       = "${key}"
-
-    region      = local.clusters.gke["${key}"].location["region"]
-    project     = local.clusters.gke["${key}"].auth["project_id"]
-    credentials = local.clusters.gke["${key}"].auth["credentials"]
+locals {
+  backend = local.backends[keys(local.backends)[0]]
+  backend_type = local.backend.type
+  backend_args = join("\n", compact([
+    for key, value in local.backend.args:
+      value != null ? format("    %s = \"%s\"", key, value) : null
+  ]))
+}
+
+resource "null_resource" "backend" {
+  triggers = {
+    config = jsonencode(local.backend)
+  }
+  provisioner "local-exec" {
+    interpreter = ["/bin/bash", "-c"]
+    command = <<-EOT
+      cat > ${path.module}/backend.tf <<EOF
+terraform {
+  backend "${local.backend_type}" {
+${local.backend_args}
+  }
+}
+EOF
+      echo "backend.tf created successfully."
+    EOT
+  }
+
+  lifecycle {
+    precondition {
+      condition = length(local.backends) == 1
+      error_message = "Exactly one backend must be enabled."
+    }
+  }
+}
+
+resource "null_resource" "clusters" {
+  triggers = {
+    config = jsonencode(local.clusters)
   }
+  provisioner "local-exec" {
+    interpreter = ["/bin/bash", "-c"]
+    command = <<-EOT
+      cat > ${path.module}/clusters.tf <<EOF
+### GKE ####
+%{ for key in keys(local.clusters.gke) }
+provider "google" {
+  alias       = "${key}"
+
+  region      = local.clusters.gke["${key}"].location["region"]
+  project     = local.clusters.gke["${key}"].auth["project_id"]
+  credentials = local.clusters.gke["${key}"].auth["credentials"]
+}
 
-  provider "kubernetes" {
-    alias                  = "${key}"
+provider "kubernetes" {
+  alias                  = "${key}"
 
+  host                   = module.${key}.kube_config["host"]
+  cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
+  client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
+  client_key             = module.${key}.kube_config["client_key"]
+  token                  = module.${key}.kube_config["token"]
+}
+
+provider "helm" {
+  alias = "${key}"
+
+  kubernetes = {
     host                   = module.${key}.kube_config["host"]
     cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
     client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
     client_key             = module.${key}.kube_config["client_key"]
     token                  = module.${key}.kube_config["token"]
   }
+}
 
-  provider "helm" {
-    alias = "${key}"
+module "${key}" {
+  source    = "./modules/gke"
 
-    kubernetes = {
-      host                   = module.${key}.kube_config["host"]
-      cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
-      client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
-      client_key             = module.${key}.kube_config["client_key"]
-      token                  = module.${key}.kube_config["token"]
-    }
-  }
+  cluster   = local.clusters.gke["${key}"]
+  forgerock = var.forgerock
 
-  module "${key}" {
-    source    = "./modules/gke"
+  providers = {
+    google     = google.${key}
+    kubernetes = kubernetes.${key}
+    helm       = helm.${key}
+  }
+  depends_on = [null_resource.clusters]
+}
 
-    cluster   = local.clusters.gke["${key}"]
-    forgerock = var.forgerock
+output "${key}" {
+  value = format("\n\nGKE Cluster Configuration: %s\n%s\n", "${key}", module.${key}.cluster_info)
+}
+%{ endfor }
 
-    providers = {
-      google     = google.${key}
-      kubernetes = kubernetes.${key}
-      helm       = helm.${key}
-    }
-    depends_on = [local_file.clusters]
-  }
+### EKS ####
+%{ for key in keys(local.clusters.eks) }
+provider "aws" {
+  alias      = "${key}"
 
-  output "${key}" {
-    value = format("\n\nGKE Cluster Configuration: %s\n%s\n", "${key}", module.${key}.cluster_info)
-  }
-  %{ endfor }
+  region     = local.clusters.eks["${key}"].location["region"]
+  access_key = local.clusters.eks["${key}"].auth["access_key"]
+  secret_key = local.clusters.eks["${key}"].auth["secret_key"]
+}
 
-  ### EKS ####
-  %{ for key in keys(local.clusters.eks) }
-  provider "aws" {
-    alias      = "${key}"
+provider "kubernetes" {
+  alias                  = "${key}"
 
-    region     = local.clusters.eks["${key}"].location["region"]
-    access_key = local.clusters.eks["${key}"].auth["access_key"]
-    secret_key = local.clusters.eks["${key}"].auth["secret_key"]
-  }
+  host                   = module.${key}.kube_config["host"]
+  cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
+  client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
+  client_key             = module.${key}.kube_config["client_key"]
+  token                  = module.${key}.kube_config["token"]
+}
 
-  provider "kubernetes" {
-    alias                  = "${key}"
+provider "helm" {
+  alias = "${key}"
 
+  kubernetes = {
     host                   = module.${key}.kube_config["host"]
     cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
     client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
     client_key             = module.${key}.kube_config["client_key"]
     token                  = module.${key}.kube_config["token"]
   }
+}
 
-  provider "helm" {
-    alias = "${key}"
+module "${key}" {
+  source    = "./modules/eks"
 
-    kubernetes = {
-      host                   = module.${key}.kube_config["host"]
-      cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
-      client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
-      client_key             = module.${key}.kube_config["client_key"]
-      token                  = module.${key}.kube_config["token"]
-    }
+  cluster   = local.clusters.eks["${key}"]
+  forgerock = var.forgerock
+
+  providers = {
+    aws        = aws.${key}
+    kubernetes = kubernetes.${key}
+    helm       = helm.${key}
   }
+  depends_on = [null_resource.clusters]
+}
 
-  module "${key}" {
-    source    = "./modules/eks"
+output "${key}" {
+  value = format("\n\nEKS Cluster Configuration: %s\n%s\n", "${key}", module.${key}.cluster_info)
+}
+%{ endfor }
 
-    cluster   = local.clusters.eks["${key}"]
-    forgerock = var.forgerock
+### AKS ####
+%{ for key in keys(local.clusters.aks) }
+provider "azurerm" {
+  alias = "${key}"
 
-    providers = {
-      aws        = aws.${key}
-      kubernetes = kubernetes.${key}
-      helm       = helm.${key}
+  features {
+    resource_group {
+      prevent_deletion_if_contains_resources = false
     }
-    depends_on = [local_file.clusters]
   }
 
-  output "${key}" {
-    value = format("\n\nEKS Cluster Configuration: %s\n%s\n", "${key}", module.${key}.cluster_info)
-  }
-  %{ endfor }
+  #skip_provider_registration = true
+}
 
-  ### AKS ####
-  %{ for key in keys(local.clusters.aks) }
-  provider "azurerm" {
-    alias = "${key}"
+provider "kubernetes" {
+  alias                  = "${key}"
 
-    features {
-      resource_group {
-        prevent_deletion_if_contains_resources = false
-      }
-    }
-
-    #skip_provider_registration = true
-  }
+  host                   = module.${key}.kube_config["host"]
+  cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
+  client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
+  client_key             = base64decode(module.${key}.kube_config["client_key"])
+  token                  = module.${key}.kube_config["token"]
+}
 
-  provider "kubernetes" {
-    alias                  = "${key}"
+provider "helm" {
+  alias = "${key}"
 
+  kubernetes = {
     host                   = module.${key}.kube_config["host"]
     cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
     client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
     client_key             = base64decode(module.${key}.kube_config["client_key"])
     token                  = module.${key}.kube_config["token"]
   }
+}
 
-  provider "helm" {
-    alias = "${key}"
-
-    kubernetes = {
-      host                   = module.${key}.kube_config["host"]
-      cluster_ca_certificate = base64decode(module.${key}.kube_config["cluster_ca_certificate"])
-      client_certificate     = base64decode(module.${key}.kube_config["client_certificate"])
-      client_key             = base64decode(module.${key}.kube_config["client_key"])
-      token                  = module.${key}.kube_config["token"]
-    }
-  }
-
-  module "${key}" {
-    source    = "./modules/aks"
+module "${key}" {
+  source    = "./modules/aks"
 
-    cluster   = local.clusters.aks["${key}"]
-    forgerock = var.forgerock
+  cluster   = local.clusters.aks["${key}"]
+  forgerock = var.forgerock
 
-    providers = {
-      azurerm    = azurerm.${key}
-      kubernetes = kubernetes.${key}
-      helm       = helm.${key}
-    }
-    depends_on = [local_file.clusters]
+  providers = {
+    azurerm    = azurerm.${key}
+    kubernetes = kubernetes.${key}
+    helm       = helm.${key}
   }
+  depends_on = [null_resource.clusters]
+}
 
-  output "${key}" {
-    value = format("\n\nAKS Cluster Configuration: %s\n%s\n", "${key}", module.${key}.cluster_info)
+output "${key}" {
+  value = format("\n\nAKS Cluster Configuration: %s\n%s\n", "${key}", module.${key}.cluster_info)
+}
+%{ endfor }
+EOF
+      echo "clusters.tf created successfully."
+    EOT
   }
-  %{ endfor }
-  EOF
+  depends_on = [null_resource.backend]
 }
 
diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars
index d89c397..48cf00e 100644
--- a/terraform/terraform.tfvars
+++ b/terraform/terraform.tfvars
@@ -15,6 +15,44 @@ forgerock = {
   es_zone         = null
 }
 
+# Only one backend may be enabled at a time.
+backends = {
+  local = {
+    enabled = true
+    type    = "local"
+    args = {
+      path = "terraform.tfstate"
+    }
+  }
+  gcs = {
+    enabled = false
+    type    = "gcs"
+    args = {
+      bucket = "tf-state"
+      prefix = "terraform/state"
+    }
+  }
+  s3 = {
+    enabled = false
+    type    = "s3"
+    args = {
+      bucket = "tf-state"
+      key    = "terraform/state"
+      region = "us-east-1"
+    }
+  }
+  azurerm = {
+    enabled = false
+    type    = "azurerm"
+    args = {
+      access_key           = null
+      storage_account_name = null
+      container_name       = "tfstate"
+      key                  = "terraform.tfstate"
+    }
+  }
+}
+
 clusters = {
   tf_cluster_gke_small = {
     enabled = false
diff --git a/terraform/tf-apply b/terraform/tf-apply
index 60f582f..f3282a1 100755
--- a/terraform/tf-apply
+++ b/terraform/tf-apply
@@ -16,7 +16,8 @@ terraform="$terraform_bin -chdir=$terraform_dir"
 
 set -e
 $terraform init -upgrade
-$terraform apply -target=local_file.clusters -auto-approve -compact-warnings $*
+$terraform apply -target=null_resource.backend -auto-approve -compact-warnings -concise $*
+$terraform apply -target=null_resource.clusters -auto-approve -compact-warnings -concise $*
 $terraform init -upgrade
 $terraform apply $*
 
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 33a1aab..f0cd431 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -35,6 +35,24 @@ variable "forgerock" {
   }
 }
 
+variable "backends" {
+  description = "Backend settings"
+  type = map(object({
+    enabled = bool
+    type    = string
+    args = object({
+      path   = optional(string)
+      bucket = optional(string)
+      prefix = optional(string)
+      key    = optional(string)
+      region = optional(string)
+      access_key           = optional(string)
+      storage_account_name = optional(string)
+      container_name       = optional(string)
+    })
+  }))
+}
+
 variable "clusters" {
   description = "Cluster settings"
   type = map(object({