State encryption at rest in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does state encryption at rest mean in Terraform?

It means the Terraform state file is stored securely so that its data is protected from unauthorized access when saved on disk or cloud storage.

beginner

Why is encrypting Terraform state at rest important?

Because the state file contains sensitive information like resource IDs and secrets, encrypting it prevents data leaks if storage is compromised.

intermediate

How do you enable state encryption at rest when using AWS S3 as backend in Terraform?

You enable server-side encryption by configuring the S3 bucket to use SSE-S3 with AES256 or SSE-KMS using AWS KMS keys.

intermediate

What Terraform backend supports automatic encryption of state files by default?

Terraform Cloud and Terraform Enterprise automatically encrypt state files at rest without extra configuration.

intermediate

Give an example of enabling encryption at rest for Terraform state using Azure Blob Storage backend.

In Azure Blob Storage, encryption at rest is enabled by default. You just configure the backend with the storage account and container, and Azure handles encryption automatically.

What is the main purpose of encrypting Terraform state at rest?

A To reduce the size of the state file

B To speed up Terraform apply operations

C To protect sensitive data in the state file from unauthorized access

D To enable multi-user collaboration

Encrypting state at rest protects sensitive information stored in the state file from being accessed by unauthorized users.

Which Terraform backend encrypts state files automatically without extra setup?

A Local backend

B Terraform Cloud

C AWS S3 without encryption enabled

D Azure Blob Storage without encryption enabled

Terraform Cloud automatically encrypts state files at rest by default.

How can you enable encryption for Terraform state stored in AWS S3?

A Use local backend instead

B No encryption is possible with S3

C Encrypt the state file manually before upload

D Configure server-side encryption with AES256 or KMS keys on the S3 bucket

AWS S3 supports server-side encryption which can be enabled by configuring the bucket for SSE-S3 (AES256) or SSE-KMS with AWS KMS keys.

What sensitive information might be exposed if Terraform state is not encrypted at rest?

A Resource IDs and secrets

B Terraform version number

C Terraform CLI commands history

D User login credentials

Terraform state files contain resource IDs, secrets, and other sensitive data that should be protected.

Which cloud provider's storage encrypts Terraform state at rest by default?

A Azure Blob Storage

B AWS S3 without configuration

C Google Cloud Storage without configuration

D Local filesystem

Azure Blob Storage encrypts data at rest by default, so Terraform state stored there is encrypted automatically.

Explain why encrypting Terraform state at rest is a best practice and how it protects your infrastructure data.

Think about what information is stored in the state file and why it needs protection.

Describe how you would configure encryption at rest for Terraform state using AWS S3 backend.

Focus on backend settings and AWS encryption options.