State encryption at rest in Terraform - Mini Project: Build & Apply

Encrypt Terraform State at Rest

📖 Scenario: You are managing infrastructure using Terraform. To keep your infrastructure state safe, you want to encrypt the Terraform state file when stored remotely.This is like locking your important documents in a safe so only you can open them.

🎯 Goal: Create a Terraform backend configuration that stores the state file in an AWS S3 bucket with encryption enabled to protect the state at rest.

📋 What You'll Learn

Use an aws_s3_bucket resource named tf_state_bucket with versioning enabled

Configure the S3 bucket to use server-side encryption with AWS managed keys (SSE-S3)

Set up a Terraform backend block to use the S3 bucket tf_state_bucket for remote state storage

Enable encryption in the backend configuration

💡 Why This Matters

🌍 Real World

Encrypting Terraform state files protects sensitive infrastructure data from unauthorized access when stored remotely.

💼 Career

Cloud engineers and DevOps professionals must secure infrastructure state files to maintain compliance and security best practices.

1

Create an AWS S3 bucket for Terraform state

Create an aws_s3_bucket resource named tf_state_bucket with the bucket name my-terraform-state-bucket and enable versioning by adding an aws_s3_bucket_versioning resource named tf_state_bucket_versioning for the same bucket.

Terraform

# Your code here to create the S3 bucket and enable versioning

Hint

Use resource "aws_s3_bucket" "tf_state_bucket" to create the bucket and resource "aws_s3_bucket_versioning" "tf_state_bucket_versioning" to enable versioning.

2

Add server-side encryption configuration to the S3 bucket

Add a server_side_encryption_configuration block inside the aws_s3_bucket resource tf_state_bucket to enable server-side encryption using AWS managed keys (SSE-S3).

Terraform

resource "aws_s3_bucket" "tf_state_bucket" {
  bucket = "my-terraform-state-bucket"
  acl    = "private"
  # Add server-side encryption configuration here
}

resource "aws_s3_bucket_versioning" "tf_state_bucket_versioning" {
  bucket = aws_s3_bucket.tf_state_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

Hint

Inside the bucket resource, add server_side_encryption_configuration with sse_algorithm = "AES256" to enable SSE-S3 encryption.

3

Configure Terraform backend to use the encrypted S3 bucket

Add a terraform block with a backend configuration using s3. Set bucket to my-terraform-state-bucket, key to terraform.tfstate, and region to us-east-1. Enable encryption by setting encrypt to true.

Terraform

resource "aws_s3_bucket" "tf_state_bucket" {
  bucket = "my-terraform-state-bucket"
  acl    = "private"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
}

resource "aws_s3_bucket_versioning" "tf_state_bucket_versioning" {
  bucket = aws_s3_bucket.tf_state_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

terraform {
  # Add backend configuration here
}

Hint

Use a terraform block with backend "s3" and set encrypt = true to enable encryption of the state file.

4

Finalize and validate the Terraform state encryption setup

Ensure the full Terraform configuration includes the aws_s3_bucket with encryption, versioning, and the terraform backend block with encryption enabled. Confirm the bucket name is my-terraform-state-bucket and the backend key is terraform.tfstate.

Terraform

# Review and finalize your Terraform configuration here

Hint

Check that all parts are included: bucket with encryption, versioning, and backend with encryption enabled.

Practice

1. What is the main purpose of enabling state encryption at rest in Terraform?

easy

A. To reduce the size of the Terraform state file

B. To speed up Terraform plan and apply operations

C. To automatically backup the state file to multiple regions

D. To protect the Terraform state file from unauthorized access

Solution

1. Step 1: Understand what state encryption means

   Encryption at rest means protecting stored data from unauthorized reading.

2. Step 2: Apply this to Terraform state files

   Terraform state files contain sensitive infrastructure data, so encrypting them protects this data.

3. Final Answer:

   To protect the Terraform state file from unauthorized access -> Option D

4. Quick Check:

   State encryption = protect data [OK]

Hint: Encryption protects stored state data from unauthorized access [OK]

Common Mistakes:

• Confusing encryption with performance improvement
• Thinking encryption reduces file size
• Assuming encryption automatically backs up data

2. Which of the following is the correct way to enable encryption for an S3 backend in Terraform?

easy

A. encryption_enabled = yes

B. encrypt = true

C. enable_encryption = on

D. kms_encryption = true

Solution

1. Step 1: Recall the S3 backend encryption syntax

   The correct attribute to enable encryption is encrypt = true.

2. Step 2: Verify other options are invalid

   Other options are not valid Terraform backend configuration keys.

3. Final Answer:

   encrypt = true -> Option B

4. Quick Check:

   Correct syntax = encrypt = true [OK]

Hint: Use exact key 'encrypt = true' to enable S3 backend encryption [OK]

Common Mistakes:

• Using incorrect attribute names
• Using 'yes' or 'on' instead of true
• Confusing KMS key setting with encryption toggle

3. Given this Terraform backend configuration snippet for S3:

backend "s3" {
  bucket = "my-terraform-state"
  key    = "state.tfstate"
  region = "us-east-1"
  encrypt = true
  kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
}

What is the effect of specifying kms_key_id here?

medium

A. It uses the specified KMS key to encrypt the state file instead of the default AWS key

B. It disables encryption and uses the KMS key only for access control

C. It backs up the state file to the KMS key's region

D. It automatically rotates the state file encryption key daily

Solution

1. Step 1: Understand the role of kms_key_id in S3 backend

   Specifying kms_key_id tells Terraform to use a custom AWS KMS key for encryption.

2. Step 2: Compare with default behavior

   If kms_key_id is not set, AWS uses a default managed key for encryption.

3. Final Answer:

   It uses the specified KMS key to encrypt the state file instead of the default AWS key -> Option A

4. Quick Check:

   kms_key_id = custom encryption key [OK]

Hint: kms_key_id sets custom encryption key, not disables encryption [OK]

Common Mistakes:

• Thinking kms_key_id disables encryption
• Confusing kms_key_id with backup location
• Assuming automatic key rotation

4. You wrote this backend configuration for S3:

backend "s3" {
  bucket = "my-bucket"
  key = "terraform.tfstate"
  region = "us-west-2"
  encrypt = "true"
}

Terraform throws an error when initializing. What is the problem?

medium

A. The key attribute is missing

B. The bucket name is invalid

C. The value for encrypt should be a boolean, not a string

D. The region value is incorrect

Solution

1. Step 1: Check the encrypt attribute type

   Terraform expects encrypt to be a boolean (true/false), not a string.

2. Step 2: Confirm other attributes are correct

   Bucket name, key, and region are valid and present.

3. Final Answer:

   The value for encrypt should be a boolean, not a string -> Option C

4. Quick Check:

   encrypt must be boolean true/false [OK]

Hint: Use true without quotes for boolean values in Terraform [OK]

Common Mistakes:

• Putting boolean values in quotes
• Assuming bucket or region is wrong without checking
• Missing required attributes

5. You want to ensure your Terraform state stored in an S3 bucket is encrypted using a specific KMS key. Which configuration snippet correctly achieves this?

hard

A. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
}

B. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = false
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
force_destroy = true
}

C. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = ""
force_destroy = true
}

D. backend "s3" {
bucket = "my-secure-bucket"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/secure-key"
force_destroy = true
}

Solution

1. Step 1: Enable encryption with a specific KMS key

   Set encrypt = true and provide the kms_key_id ARN for custom encryption.

2. Step 2: Verify other options are incorrect

   A has encrypt = false (disables encryption); C has empty kms_key_id; A, C, D include invalid force_destroy parameter (causes terraform init error).

3. Final Answer:

   Configuration with encrypt=true and kms_key_id set -> Option A

4. Quick Check:

   Valid S3 backend with custom KMS encryption [OK]

Hint: Use encrypt=true and kms_key_id to encrypt state with custom KMS key [OK]

Common Mistakes:

• Disabling encryption by setting encrypt=false
• Using empty kms_key_id
• Adding invalid parameters like force_destroy to backend config