State encryption at rest in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Enable encryption for Terraform state in AWS S3 backend

You want to ensure your Terraform state file stored in an AWS S3 bucket is encrypted at rest using AWS-managed keys. Which backend configuration snippet correctly enables this?

A

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  server_side_encryption = "AES256"
}

B

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  sse_algorithm = "AES256"
}

C

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  encrypt = true
}

D

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  server_side_encryption = true
}

💡 Hint

Look for the correct attribute name and value to enable AWS S3 server-side encryption with AWS-managed keys.

In Terraform's S3 backend, the correct attribute to enable server-side encryption with AWS-managed keys is encrypt = true. The attribute server_side_encryption is not valid for the S3 backend configuration. The attribute sse_algorithm does not exist. Setting server_side_encryption to true is invalid because it expects a boolean.

❓ Architecture

intermediate

Choosing backend for encrypted Terraform state storage

You want to store Terraform state securely with encryption at rest and easy team access. Which backend choice best meets these requirements?

A Use S3 backend with server-side encryption enabled and DynamoDB for state locking.

B Use HTTP backend with a custom server that encrypts state files before saving.

C Use Terraform Cloud remote backend without additional encryption configuration.

D Use local backend storing state on your laptop's disk with filesystem encryption enabled.

💡 Hint

Consider managed services that provide encryption and locking out of the box.

The S3 backend with server-side encryption enabled ensures state files are encrypted at rest. Using DynamoDB for state locking prevents concurrent modifications. Local backend depends on your laptop's security and is not suitable for team access. HTTP backend requires custom setup and is less secure. Terraform Cloud encrypts state at rest by default but may require paid plans for team features.

❓ security

advanced

Impact of disabling encryption on Terraform state in S3

What is the most likely outcome if you disable server-side encryption on an existing S3 bucket storing Terraform state files?

A New state files will be stored unencrypted, exposing sensitive data at rest.

B S3 will automatically encrypt all objects regardless of bucket settings.

C Terraform will refuse to write state files due to missing encryption settings.

D Terraform state files will remain encrypted because existing objects keep their encryption metadata.

💡 Hint

Think about how S3 encryption settings affect new and existing objects.

Disabling server-side encryption on the bucket means new objects uploaded will not be encrypted unless specified. Existing objects remain encrypted until overwritten. Terraform will not refuse writes due to encryption settings. S3 does not automatically encrypt objects if encryption is disabled.

❓ service_behavior

advanced

Behavior of Terraform state encryption with KMS CMK

You configure your S3 backend to use a customer-managed AWS KMS key (CMK) for encrypting Terraform state. What happens if the KMS key is disabled?

A Terraform automatically switches to AWS-managed keys for encryption.

B Terraform can still read and write state files without issues.

C Terraform fails to write new state files but can read existing ones.

D Terraform fails to read and write state files until the key is enabled.

💡 Hint

Consider how KMS key status affects access to encrypted objects.

If the customer-managed KMS key is disabled, Terraform cannot decrypt existing state files or encrypt new ones. This causes read and write operations to fail. Terraform does not automatically switch keys.

✅ Best Practice

expert

Ensuring Terraform state encryption and access control in multi-account AWS setup

You manage Terraform state in a central AWS account's S3 bucket encrypted with a KMS key. Multiple AWS accounts need to access this state securely. Which approach best ensures encryption at rest and least privilege access?

A Use a KMS key policy granting only the central account access, and replicate state files to each account's bucket.

B Configure the KMS key policy to allow decrypt/encrypt only for specific IAM roles in each account, and restrict S3 bucket access similarly.

C Share the S3 bucket and KMS key policies to allow all accounts full access to the bucket and key.

D Disable KMS encryption and rely on S3 bucket policies to restrict access to all accounts.

💡 Hint

Think about how to limit encryption key usage and S3 access to only authorized roles.

Best practice is to restrict KMS key usage to specific IAM roles in each account that need access, and similarly restrict S3 bucket permissions. This enforces least privilege and maintains encryption at rest. Sharing full access or disabling encryption weakens security. Replicating state files increases complexity and risk.

Practice

1. What is the main purpose of enabling state encryption at rest in Terraform?

easy

A. To reduce the size of the Terraform state file

B. To speed up Terraform plan and apply operations

C. To automatically backup the state file to multiple regions

D. To protect the Terraform state file from unauthorized access

Solution

1. Step 1: Understand what state encryption means

   Encryption at rest means protecting stored data from unauthorized reading.

2. Step 2: Apply this to Terraform state files

   Terraform state files contain sensitive infrastructure data, so encrypting them protects this data.

3. Final Answer:

   To protect the Terraform state file from unauthorized access -> Option D

4. Quick Check:

   State encryption = protect data [OK]

Hint: Encryption protects stored state data from unauthorized access [OK]

Common Mistakes:

• Confusing encryption with performance improvement
• Thinking encryption reduces file size
• Assuming encryption automatically backs up data

2. Which of the following is the correct way to enable encryption for an S3 backend in Terraform?

easy

A. encryption_enabled = yes

B. encrypt = true

C. enable_encryption = on

D. kms_encryption = true

Solution

1. Step 1: Recall the S3 backend encryption syntax

   The correct attribute to enable encryption is encrypt = true.

2. Step 2: Verify other options are invalid

   Other options are not valid Terraform backend configuration keys.

3. Final Answer:

   encrypt = true -> Option B

4. Quick Check:

   Correct syntax = encrypt = true [OK]

Hint: Use exact key 'encrypt = true' to enable S3 backend encryption [OK]

Common Mistakes:

• Using incorrect attribute names
• Using 'yes' or 'on' instead of true
• Confusing KMS key setting with encryption toggle

3. Given this Terraform backend configuration snippet for S3:

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  encrypt = true
  kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
}

What is the effect of specifying kms_key_id here?

medium

A. It uses the specified KMS key to encrypt the state file instead of the default AWS key

B. It disables encryption and uses the KMS key only for access control

C. It backs up the state file to the KMS key's region

D. It automatically rotates the state file encryption key daily

Solution

1. Step 1: Understand the role of kms_key_id in S3 backend

   Specifying kms_key_id tells Terraform to use a custom AWS KMS key for encryption.

2. Step 2: Compare with default behavior

   If kms_key_id is not set, AWS uses a default managed key for encryption.

3. Final Answer:

   It uses the specified KMS key to encrypt the state file instead of the default AWS key -> Option A

4. Quick Check:

   kms_key_id = custom encryption key [OK]

Hint: kms_key_id sets custom encryption key, not disables encryption [OK]

Common Mistakes:

• Thinking kms_key_id disables encryption
• Confusing kms_key_id with backup location
• Assuming automatic key rotation

4. You wrote this backend configuration for S3:

backend "s3" {
  bucket = "my-bucket"
  key = "terraform.tfstate"
  region = "us-west-2"
  encrypt = "true"
}

Terraform throws an error when initializing. What is the problem?

medium

A. The key attribute is missing

B. The bucket name is invalid

C. The value for encrypt should be a boolean, not a string

D. The region value is incorrect

Solution

1. Step 1: Check the encrypt attribute type

   Terraform expects encrypt to be a boolean (true/false), not a string.

2. Step 2: Confirm other attributes are correct

   Bucket name, key, and region are valid and present.

3. Final Answer:

   The value for encrypt should be a boolean, not a string -> Option C

4. Quick Check:

   encrypt must be boolean true/false [OK]

Hint: Use true without quotes for boolean values in Terraform [OK]

Common Mistakes:

• Putting boolean values in quotes
• Assuming bucket or region is wrong without checking
• Missing required attributes

5. You want to ensure your Terraform state stored in an S3 bucket is encrypted using a specific KMS key. Which configuration snippet correctly achieves this?

hard

A. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
}

B. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = false
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
force_destroy = true
}

C. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = ""
force_destroy = true
}

D. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
force_destroy = true
}

Solution

1. Step 1: Enable encryption with a specific KMS key

   Set encrypt = true and provide the kms_key_id ARN for custom encryption.

2. Step 2: Verify other options are incorrect

   A has encrypt = false (disables encryption); C has empty kms_key_id; A, C, D include invalid force_destroy parameter (causes terraform init error).

3. Final Answer:

   Configuration with encrypt=true and kms_key_id set -> Option A

4. Quick Check:

   Valid S3 backend with custom KMS encryption [OK]

Hint: Use encrypt=true and kms_key_id to encrypt state with custom KMS key [OK]

Common Mistakes:

• Disabling encryption by setting encrypt=false
• Using empty kms_key_id
• Adding invalid parameters like force_destroy to backend config