State file sensitivity and security in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the backend type for storing Terraform state remotely.

Terraform

terraform {
  backend "[1]" {}
}

Drag options to blanks, or click blank then click option'

Afile

Blocal

Chttp

Ds3

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'local' backend stores state on the local machine, which is not secure for team environments.

Using 'file' is not a valid backend type in Terraform.

The s3 backend stores the Terraform state file securely in an AWS S3 bucket, which is a common practice for remote state management.

2fill in blank

medium

Complete the code to enable state locking using DynamoDB to prevent concurrent modifications.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-east-1"
    dynamodb_table = "[1]"
  }
}

Drag options to blanks, or click blank then click option'

Aterraform-locks

Bstate-lock

Clock-table

Dterraform-state-lock

Attempts:

3 left

💡 Hint

Common Mistakes

Using a table name unrelated to locking can cause locking to fail.

Leaving this attribute empty disables state locking, risking concurrent state changes.

The dynamodb_table attribute specifies the DynamoDB table used for state locking. 'terraform-locks' is a common table name for this purpose.

3fill in blank

hard

Fix the error in the backend configuration to encrypt the state file at rest.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-east-1"
    encrypt        = [1]
  }
}

Drag options to blanks, or click blank then click option'

Atrue

B"true"

CTrue

Dyes

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around true makes it a string, which is invalid.

Using capitalized True is not valid in Terraform HCL.

The encrypt attribute expects a boolean value true without quotes to enable encryption of the state file at rest.

4fill in blank

hard

Fill both blanks to configure remote state with S3 backend and enable encryption for state file safety.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-east-1"
    [1] = true
    [2] = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
  }
}

Drag options to blanks, or click blank then click option'

Aversioning

Bkms_key_id

Cencrypt

Ddynamodb_table

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'versioning' is not a valid backend attribute in Terraform.

Confusing 'dynamodb_table' with encryption settings.

The encrypt attribute enables encryption of the state file, and kms_key_id specifies the AWS KMS key ARN used for encryption.

5fill in blank

hard

Fill all three blanks to define a secure backend with S3 bucket, DynamoDB locking, and encryption enabled.

Terraform

terraform {
  backend "s3" {
    bucket         = "[1]"
    key            = "terraform.tfstate"
    region         = "us-west-2"
    dynamodb_table = "[2]"
    encrypt        = [3]
  }
}

Drag options to blanks, or click blank then click option'

Asecure-terraform-state

Bterraform-locks

Ctrue

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting encrypt to false disables encryption, which is insecure.

Using incorrect or missing DynamoDB table disables locking.

The bucket is the S3 bucket name, dynamodb_table is the table used for locking, and encrypt set to true enables encryption of the state file.