State file sensitivity and security in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Terraform state file?

A Terraform state file is a file that keeps track of the resources Terraform manages. It stores information about the infrastructure's current state so Terraform knows what to create, update, or delete.

beginner

Why is the Terraform state file sensitive?

The state file contains detailed information about your infrastructure, including resource IDs, IP addresses, and sometimes secrets or passwords. If exposed, it can lead to security risks.

intermediate

Name one best practice to secure Terraform state files.

Store the state file remotely in a secure backend like AWS S3 with encryption and access controls, instead of keeping it locally on your computer.

intermediate

What is Terraform remote state locking and why is it important?

Remote state locking prevents multiple people from changing the state file at the same time. This avoids conflicts and corruption of the state file.

advanced

How can you avoid storing sensitive data in the Terraform state file?

Use Terraform's sensitive variables feature and avoid outputting secrets. Also, use external secret managers to keep secrets outside the state file.

What does the Terraform state file primarily store?

A Current infrastructure resource information

B Terraform source code

C User login credentials

D Cloud provider billing details

The state file stores information about the current infrastructure resources Terraform manages.

Why should Terraform state files be stored securely?

A They are very large files

B They contain Terraform version info

C They contain sensitive infrastructure details

D They are only used for logging

State files contain sensitive details like resource IDs and sometimes secrets, so securing them is important.

Which backend is recommended for storing Terraform state securely?

A Local disk without encryption

B Remote backend with encryption and access control

C Public GitHub repository

D Temporary cloud storage without access control

Using a remote backend with encryption and access control protects the state file from unauthorized access.

What problem does remote state locking solve?

A Prevents multiple users from editing state simultaneously

B Encrypts the state file

C Backs up the state file automatically

D Improves Terraform execution speed

Remote state locking prevents concurrent edits that could corrupt the state file.

How can you keep secrets out of the Terraform state file?

A Ignore the state file in version control

B Store secrets in plain text variables

C Output secrets in Terraform outputs

D Use sensitive variables and external secret managers

Using sensitive variables and external secret managers keeps secrets out of the state file.

Explain why Terraform state files are sensitive and how you can protect them.

Think about what info the state file holds and how to keep it safe.

Describe best practices to avoid exposing sensitive data in Terraform state files.

Focus on how to handle secrets and state storage.