How should I structure Terraform state for a multi-environment landing zone?

Separate state files per environment (dev/staging/prod) at minimum, and consider separating further by logical layer (networking, IAM, workloads) so a workload-layer apply can never accidentally touch network or IAM state.

Why this matters

A shared state file across environments is the single most common cause of a Terraform apply accidentally affecting production while intending to change staging.