State file encryption in Terraform - Mini Project: Build & Apply

State file encryption

📖 Scenario: You are managing infrastructure using Terraform. To keep your infrastructure state file safe, you want to enable encryption for the state file stored remotely.

🎯 Goal: Create a Terraform backend configuration that stores the state file in an AWS S3 bucket with encryption enabled.

📋 What You'll Learn

Create a Terraform backend configuration using AWS S3

Specify the S3 bucket name as my-terraform-state-bucket

Set the key for the state file as terraform.tfstate

Enable server-side encryption using AWS managed keys (SSE-S3)

💡 Why This Matters

🌍 Real World

Terraform state files contain sensitive information about your infrastructure. Encrypting them protects against unauthorized access and data leaks.

💼 Career

Cloud engineers and DevOps professionals must secure infrastructure state files to maintain compliance and protect cloud resources.

1

Create backend configuration with S3 bucket and key

Create a Terraform backend configuration block with bucket set to "my-terraform-state-bucket" and key set to "terraform.tfstate" inside terraform block.

Terraform

terraform {
  # Your code here
}

Need a hint?

Use the terraform block with a nested backend "s3" block. Set bucket and key exactly as specified.

2

Add region configuration

Inside the existing backend "s3" block, add the region attribute and set it to "us-west-2".

Terraform

terraform {
  backend "s3" {
    bucket = "my-terraform-state-bucket"
    key    = "terraform.tfstate"
    # Your code here
  }
}

Need a hint?

Add the region attribute inside the backend "s3" block with the value "us-west-2".

3

Enable server-side encryption

Add the encrypt attribute inside the backend "s3" block and set it to true to enable server-side encryption.

Terraform

terraform {
  backend "s3" {
    bucket = "my-terraform-state-bucket"
    key    = "terraform.tfstate"
    region = "us-west-2"
    # Your code here
  }
}

Need a hint?

Set encrypt = true inside the backend "s3" block to enable encryption.

4

Add DynamoDB table for state locking

Add the dynamodb_table attribute inside the backend "s3" block and set it to "terraform-lock-table" to enable state locking.

Terraform

terraform {
  backend "s3" {
    bucket = "my-terraform-state-bucket"
    key    = "terraform.tfstate"
    region = "us-west-2"
    encrypt = true
    # Your code here
  }
}

Need a hint?

Add dynamodb_table = "terraform-lock-table" inside the backend "s3" block to enable state locking.