# 1. Identify the lock ID from the error output
terraform plan -lock-timeout=5s

# 2. Inspect who holds it (S3 backend + DynamoDB)
aws dynamodb get-item --table-name terraform-locks --key '{"LockID":{"S":"my-org/prod/tfstate"}}'

# 3. Force-unlock — only after confirming nobody is applying
terraform force-unlock <LOCK_ID>

# Local state surgery fallback:
terraform force-unlock -force <LOCK_ID>