State file sensitivity and security in Terraform - Commands & Configuration

Introduction

Terraform saves information about your cloud resources in a state file. This file contains sensitive details like passwords and keys. Protecting this file is important to keep your cloud safe and avoid accidental changes.

When you want to keep track of your cloud resources and their current settings.

When multiple people work on the same cloud infrastructure and need to share resource information.

When you want to avoid losing important data about your cloud setup after changes.

When you want to prevent unauthorized access to sensitive cloud credentials stored in the state file.

When you want to safely store the state file in a remote location instead of your local computer.

Config File - backend.tf

backend.tf

terraform {
  backend "s3" {
    bucket = "example-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
    encrypt = true
  }
}

This configuration tells Terraform to store the state file in an Amazon S3 bucket.

bucket: The S3 bucket name where the state file is saved.

key: The path inside the bucket for the state file.

region: The AWS region of the bucket.

encrypt: Ensures the state file is encrypted at rest in S3.

Commands

This command initializes Terraform and sets up the backend to store the state file securely in the configured S3 bucket.

Terminal

terraform init

Expected Output

Initializing the backend...



Successfully configured the backend "s3"!



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see any changes required for your infrastructure.

This command applies your Terraform configuration and updates the state file in the secure backend automatically without asking for confirmation.

Terminal

terraform apply -auto-approve

Expected Output

aws_instance.example: Creating...

aws_instance.example: Creation complete after 10s [id=i-0abcd1234efgh5678]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Skips manual approval to apply changes immediately

This command lists all resources tracked in the current Terraform state file to verify what is saved securely.

Terminal

terraform state list

Expected Output

aws_instance.example

Key Concept

If you remember nothing else, remember: the Terraform state file contains sensitive data and must be stored securely using remote backends with encryption.

Common Mistakes

Storing the Terraform state file locally on a shared or public computer.

Local files can be accessed by unauthorized users, risking exposure of sensitive cloud credentials.

Use a remote backend like S3 with encryption and access controls to store the state file safely.

Not enabling encryption on the remote backend storing the state file.

Without encryption, the state file data can be read if the storage is compromised.

Always enable encryption options provided by the backend, such as S3 server-side encryption.

Sharing the state file publicly or committing it to version control systems like Git.

This exposes sensitive information to anyone who can access the repository.

Add the state file to .gitignore and use remote backends to avoid local state file sharing.

Summary

Configure Terraform to store the state file in a secure remote backend like S3 with encryption.

Use 'terraform init' to initialize the backend and 'terraform apply' to update resources and state safely.

Avoid storing or sharing the state file locally to protect sensitive cloud information.