State file encryption in Terraform - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of encrypting the Terraform state file?

Encrypting the Terraform state file protects sensitive data stored in it, such as passwords or keys, from unauthorized access.

beginner

Where is the Terraform state file usually stored when using remote backends?

The Terraform state file is stored in a remote backend like AWS S3, Azure Blob Storage, or Google Cloud Storage, which can support encryption.

intermediate

How do you enable encryption for a Terraform state file stored in AWS S3?

Enable server-side encryption (SSE) on the S3 bucket by setting 'server_side_encryption_configuration' or using 'sse_algorithm = "AES256"' in the backend configuration.

beginner

What is the risk of not encrypting the Terraform state file?

Without encryption, sensitive information in the state file can be exposed if the storage location is accessed by unauthorized users.

intermediate

Can Terraform encrypt the state file locally on your machine?

Terraform does not encrypt the local state file by default; encryption is usually handled by the remote backend or external tools.

What is the main benefit of enabling encryption on a Terraform state file stored remotely?

A Reduces the size of the state file

B Protects sensitive data from unauthorized access

C Speeds up Terraform apply operations

D Automatically backs up the state file

Encryption protects sensitive data in the state file from unauthorized access.

Which AWS service is commonly used to store Terraform state files with encryption?

A Amazon S3

B Amazon EC2

C Amazon RDS

D Amazon Lambda

Amazon S3 is commonly used as a remote backend for Terraform state files and supports encryption.

How do you enable server-side encryption for Terraform state files in an S3 backend?

A Enable encryption in the Terraform provider

B Encrypt the state file manually before upload

C Set 'sse_algorithm = "AES256"' in the backend configuration

D Use Terraform's local encryption feature

Setting 'sse_algorithm = "AES256"' enables server-side encryption on the S3 bucket storing the state file.

What happens if you do not encrypt your Terraform state file stored remotely?

A Terraform will encrypt it automatically

B Terraform will refuse to run

C The state file will be deleted automatically

D Sensitive data may be exposed if storage is accessed

Without encryption, sensitive data in the state file can be exposed if unauthorized users access the storage.

Does Terraform encrypt the local state file by default?

A No, encryption is handled by remote backends or external tools

B Yes, always

C Only if you enable a special flag

D Only on Windows machines

Terraform does not encrypt local state files by default; encryption is usually managed by remote backends.

Explain why encrypting the Terraform state file is important and how it can be done when using AWS S3 as a backend.

Think about what sensitive information the state file holds and how AWS S3 can secure it.

Describe the risks of not encrypting your Terraform state file and what best practices you should follow to secure it.

Consider what could happen if someone accesses your state file without permission.