State encryption at rest in Terraform - Commands & Configuration

Introduction

When you use Terraform to manage infrastructure, it saves information about your resources in a state file. Encrypting this state file while it is stored keeps your sensitive data safe from unauthorized access.

When you store Terraform state files in a remote backend like AWS S3 and want to protect sensitive data.

When multiple team members access the same Terraform state and you want to ensure data privacy.

When compliance rules require encryption of all stored data including infrastructure state.

When you want to prevent accidental exposure of secrets stored in the Terraform state file.

When using cloud storage backends that support encryption features to secure your state.

Config File - main.tf

main.tf

terraform {
  backend "s3" {
    bucket         = "example-terraform-state"
    key            = "state/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
  }
}

provider "aws" {
  region = "us-east-1"
}

This Terraform configuration sets up an S3 backend to store the state file remotely.

The encrypt = true option ensures that the state file is encrypted at rest using AWS S3 server-side encryption.

The bucket specifies where the state file is stored, key is the path inside the bucket, and region is the AWS region.

Commands

Initializes the Terraform working directory and configures the backend to use the S3 bucket with encryption enabled.

Terminal

terraform init

Expected Output

Initializing the backend...



Successfully configured the backend "s3"!



Terraform has been successfully initialized!



You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure.

Shows the changes Terraform will make to your infrastructure without applying them. This confirms the backend is set and ready.

Terminal

terraform plan

Expected Output

No changes. Infrastructure is up-to-date.



This means that Terraform did not detect any differences between your configuration and real physical resources.

Applies the Terraform configuration to create or update infrastructure and saves the encrypted state file in the S3 bucket.

Terminal

terraform apply -auto-approve

Expected Output

aws_s3_bucket.example: Creating...

aws_s3_bucket.example: Creation complete after 2s [id=example-terraform-state]



Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

→

-auto-approve - Automatically approves the apply step without prompting for confirmation.

Verifies that the S3 bucket storing the Terraform state has encryption enabled at rest.

Terminal

aws s3api get-bucket-encryption --bucket example-terraform-state

Expected Output

{

    "ServerSideEncryptionConfiguration": {

        "Rules": [

            {

                "ApplyServerSideEncryptionByDefault": {

                    "SSEAlgorithm": "AES256"

                }

            }

        ]

    }

}

Key Concept

If you remember nothing else from this pattern, remember: enabling encryption on your Terraform state backend protects sensitive data stored in the state file.

Common Mistakes

Not setting the 'encrypt' option to true in the S3 backend configuration.

The state file will be stored unencrypted, exposing sensitive information to anyone with access to the bucket.

Always include 'encrypt = true' in the backend block to enable server-side encryption.

Using a local backend instead of a remote backend with encryption for team environments.

Local state files are not encrypted by default and are harder to share securely among team members.

Use a remote backend like S3 with encryption enabled to securely share state.

Not verifying the bucket encryption settings after setup.

Misconfiguration can leave the bucket without encryption even if 'encrypt = true' is set in Terraform.

Use AWS CLI or cloud console to confirm encryption is active on the bucket.

Summary

Configure the Terraform backend to use an S3 bucket with 'encrypt = true' to enable state encryption at rest.

Run 'terraform init' to initialize the backend and 'terraform apply' to save the encrypted state file.

Verify encryption settings on the S3 bucket to ensure your state file is protected.

Practice

1. What is the main purpose of enabling state encryption at rest in Terraform?

easy

A. To reduce the size of the Terraform state file

B. To speed up Terraform plan and apply operations

C. To automatically backup the state file to multiple regions

D. To protect the Terraform state file from unauthorized access

Solution

1. Step 1: Understand what state encryption means

   Encryption at rest means protecting stored data from unauthorized reading.

2. Step 2: Apply this to Terraform state files

   Terraform state files contain sensitive infrastructure data, so encrypting them protects this data.

3. Final Answer:

   To protect the Terraform state file from unauthorized access -> Option D

4. Quick Check:

   State encryption = protect data [OK]

Hint: Encryption protects stored state data from unauthorized access [OK]

Common Mistakes:

• Confusing encryption with performance improvement
• Thinking encryption reduces file size
• Assuming encryption automatically backs up data

2. Which of the following is the correct way to enable encryption for an S3 backend in Terraform?

easy

A. encryption_enabled = yes

B. encrypt = true

C. enable_encryption = on

D. kms_encryption = true

Solution

1. Step 1: Recall the S3 backend encryption syntax

   The correct attribute to enable encryption is encrypt = true.

2. Step 2: Verify other options are invalid

   Other options are not valid Terraform backend configuration keys.

3. Final Answer:

   encrypt = true -> Option B

4. Quick Check:

   Correct syntax = encrypt = true [OK]

Hint: Use exact key 'encrypt = true' to enable S3 backend encryption [OK]

Common Mistakes:

• Using incorrect attribute names
• Using 'yes' or 'on' instead of true
• Confusing KMS key setting with encryption toggle

3. Given this Terraform backend configuration snippet for S3:

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  encrypt = true
  kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
}

What is the effect of specifying kms_key_id here?

medium

A. It uses the specified KMS key to encrypt the state file instead of the default AWS key

B. It disables encryption and uses the KMS key only for access control

C. It backs up the state file to the KMS key's region

D. It automatically rotates the state file encryption key daily

Solution

1. Step 1: Understand the role of kms_key_id in S3 backend

   Specifying kms_key_id tells Terraform to use a custom AWS KMS key for encryption.

2. Step 2: Compare with default behavior

   If kms_key_id is not set, AWS uses a default managed key for encryption.

3. Final Answer:

   It uses the specified KMS key to encrypt the state file instead of the default AWS key -> Option A

4. Quick Check:

   kms_key_id = custom encryption key [OK]

Hint: kms_key_id sets custom encryption key, not disables encryption [OK]

Common Mistakes:

• Thinking kms_key_id disables encryption
• Confusing kms_key_id with backup location
• Assuming automatic key rotation

4. You wrote this backend configuration for S3:

backend "s3" {
  bucket = "my-bucket"
  key = "terraform.tfstate"
  region = "us-west-2"
  encrypt = "true"
}

Terraform throws an error when initializing. What is the problem?

medium

A. The key attribute is missing

B. The bucket name is invalid

C. The value for encrypt should be a boolean, not a string

D. The region value is incorrect

Solution

1. Step 1: Check the encrypt attribute type

   Terraform expects encrypt to be a boolean (true/false), not a string.

2. Step 2: Confirm other attributes are correct

   Bucket name, key, and region are valid and present.

3. Final Answer:

   The value for encrypt should be a boolean, not a string -> Option C

4. Quick Check:

   encrypt must be boolean true/false [OK]

Hint: Use true without quotes for boolean values in Terraform [OK]

Common Mistakes:

• Putting boolean values in quotes
• Assuming bucket or region is wrong without checking
• Missing required attributes

5. You want to ensure your Terraform state stored in an S3 bucket is encrypted using a specific KMS key. Which configuration snippet correctly achieves this?

hard

A. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
}

B. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = false
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
force_destroy = true
}

C. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = ""
force_destroy = true
}

D. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
force_destroy = true
}

Solution

1. Step 1: Enable encryption with a specific KMS key

   Set encrypt = true and provide the kms_key_id ARN for custom encryption.

2. Step 2: Verify other options are incorrect

   A has encrypt = false (disables encryption); C has empty kms_key_id; A, C, D include invalid force_destroy parameter (causes terraform init error).

3. Final Answer:

   Configuration with encrypt=true and kms_key_id set -> Option A

4. Quick Check:

   Valid S3 backend with custom KMS encryption [OK]

Hint: Use encrypt=true and kms_key_id to encrypt state with custom KMS key [OK]

Common Mistakes:

• Disabling encryption by setting encrypt=false
• Using empty kms_key_id
• Adding invalid parameters like force_destroy to backend config