State file encryption in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption for the Terraform state file in an S3 backend.

Terraform

terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "state.tfstate"
    region = "us-west-2"
    [1] = true
  }
}

Drag options to blanks, or click blank then click option'

Astate_encryption

Bencryption

Cenable_encryption

Dencrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect attribute names like 'encryption' or 'enable_encryption'.

Forgetting to set the attribute to true.

The correct attribute to enable encryption in the S3 backend is encrypt. Setting it to true ensures the state file is encrypted at rest.

2fill in blank

medium

Complete the code to specify the KMS key ID for encrypting the Terraform state file in the S3 backend.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-west-2"
    encrypt        = true
    [1] = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
  }
}

Drag options to blanks, or click blank then click option'

Akms_key_id

Bkms_key

Cencryption_key

Dkey_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'kms_key' instead of 'kms_key_id'.

Using generic names like 'encryption_key' or 'key_id'.

The correct attribute to specify the KMS key for encryption in the S3 backend is kms_key_id. This tells Terraform which KMS key to use for encrypting the state file.

3fill in blank

hard

Fix the error in the backend configuration to properly enable server-side encryption with a KMS key.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-west-2"
    encrypt        = [1]
    kms_key_id     = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
  }
}

Drag options to blanks, or click blank then click option'

A"true"

BTrue

Ctrue

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around boolean values.

Using capitalized True instead of lowercase true.

The encrypt attribute expects a boolean value true without quotes. Using quotes makes it a string, which causes an error.

4fill in blank

hard

Fill both blanks to configure the S3 backend with encryption enabled and a specific KMS key.

Terraform

terraform {
  backend "s3" {
    bucket     = "my-terraform-state"
    key        = "state.tfstate"
    region     = "us-west-2"
    [1] = true
    [2] = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
  }
}

Drag options to blanks, or click blank then click option'

Aencrypt

Bkms_key

Ckms_key_id

Dencryption

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 'kms_key' with 'kms_key_id'.

Using 'encryption' instead of 'encrypt'.

The encrypt attribute enables encryption, and kms_key_id specifies the KMS key ARN for server-side encryption.

5fill in blank

hard

Fill all three blanks to create a backend configuration that enables encryption, specifies the KMS key, and sets the region.

Terraform

terraform {
  backend "s3" {
    bucket     = "my-terraform-state"
    [1] = "us-west-2"
    encrypt    = true
    [2] = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
    [3] = "state.tfstate"
  }
}

Drag options to blanks, or click blank then click option'

Aregion

Bkms_key_id

Ckey

Dbucket

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up 'bucket' and 'key' attributes.

Using incorrect attribute names for region or KMS key.

region sets the AWS region, kms_key_id specifies the KMS key ARN, and key defines the path to the state file in the bucket.

Practice

1. What is the main purpose of encrypting the Terraform state file?

easy

A. To speed up Terraform plan and apply operations

B. To allow multiple users to edit the state file simultaneously

C. To reduce the size of the state file

D. To protect sensitive data stored in the state file from unauthorized access

Solution

1. Step 1: Understand what the state file contains

   The Terraform state file stores information about your infrastructure, including sensitive data like passwords or keys.

2. Step 2: Identify the purpose of encryption

   Encrypting the state file protects this sensitive data from unauthorized users who might access the file.

3. Final Answer:

   To protect sensitive data stored in the state file from unauthorized access -> Option D

4. Quick Check:

   Encryption = Protect sensitive data [OK]

Hint: Encryption keeps secrets safe in the state file [OK]

Common Mistakes:

• Thinking encryption speeds up Terraform operations
• Believing encryption reduces file size
• Confusing encryption with multi-user editing

2. Which backend configuration snippet correctly enables encryption for an S3 Terraform state file?

easy

A. backend "s3" { bucket = "mybucket" key = "state.tfstate" secure = true region = "us-east-1" }

B. backend "s3" { bucket = "mybucket" key = "state.tfstate" encrypted = true region = "us-east-1" }

C. backend "s3" { bucket = "mybucket" key = "state.tfstate" encrypt = true region = "us-east-1" }

D. backend "s3" { bucket = "mybucket" key = "state.tfstate" encryption = "enabled" region = "us-east-1" }

Solution

1. Step 1: Recall the correct encryption option for S3 backend

   The S3 backend uses the option encrypt = true to enable server-side encryption.

2. Step 2: Check each option for correct syntax

   Only backend "s3" { bucket = "mybucket" key = "state.tfstate" encrypt = true region = "us-east-1" } uses the exact correct key encrypt with a boolean value true.

3. Final Answer:

   backend "s3" { bucket = "mybucket" key = "state.tfstate" encrypt = true region = "us-east-1" } -> Option C

4. Quick Check:

   encrypt = true is correct syntax [OK]

Hint: Use encrypt = true exactly in S3 backend config [OK]

Common Mistakes:

• Using 'encrypted' instead of 'encrypt'
• Setting encryption as a string instead of boolean
• Using unsupported keys like 'secure'

3. Given this backend configuration snippet, what will be the encryption status of the Terraform state file?

terraform {
  backend "s3" {
    bucket = "example-bucket"
    key    = "terraform.tfstate"
    region = "us-west-2"
    encrypt = false
  }
}

medium

A. The state file will be encrypted using server-side encryption

B. The state file will be encrypted only if the bucket has default encryption enabled

C. The state file will not be encrypted

D. Terraform will throw a syntax error due to invalid encrypt value

Solution

1. Step 1: Check the encrypt option value

   The configuration sets encrypt = false, which disables server-side encryption for the state file.

2. Step 2: Understand the effect of encrypt = false

   With encryption disabled, the state file is stored unencrypted in the S3 bucket unless the bucket itself enforces encryption.

3. Final Answer:

   The state file will be encrypted only if the bucket has default encryption enabled -> Option B

4. Quick Check:

   encrypt = false -> depends on bucket default encryption [OK]

Hint: encrypt = false relies on bucket encryption settings [OK]

Common Mistakes:

• Assuming encryption is always on by default
• Confusing bucket default encryption with backend encrypt option
• Expecting syntax error for boolean false

4. You configured your Terraform backend with encrypt = true for S3, but the state file is still unencrypted. What is the most likely cause?

medium

A. The encrypt option is misspelled or misplaced in the backend block

B. The S3 bucket does not have server-side encryption enabled by default

C. Terraform does not support encryption for S3 backends

D. The state file is encrypted only after the first apply

Solution

1. Step 1: Verify the encrypt option placement and spelling

   If encrypt = true is misspelled or placed outside the backend block, Terraform ignores it, so encryption won't apply.

2. Step 2: Understand Terraform's support for S3 encryption

   Terraform supports server-side encryption for S3 state files when configured correctly; bucket default encryption is optional but not required.

3. Final Answer:

   The encrypt option is misspelled or misplaced in the backend block -> Option A

4. Quick Check:

   Correct spelling and placement enable encryption [OK]

Hint: Check encrypt spelling and location in backend config [OK]

Common Mistakes:

• Assuming bucket encryption is mandatory for backend encrypt
• Believing Terraform lacks S3 encryption support
• Thinking encryption applies only after first apply

5. You want to ensure your Terraform state file is encrypted and access is tightly controlled in AWS. Which combination of settings is the best practice?

hard

A. Enable encrypt = true in the S3 backend and apply strict IAM policies limiting bucket access

B. Set encrypt = false but enable bucket default encryption and allow open read access

C. Do not use encryption but rely on local state file storage with no access controls

D. Enable encrypt = true and allow all users in the AWS account full access to the bucket

Solution

1. Step 1: Enable encryption in backend configuration

   Setting encrypt = true ensures the state file is encrypted at rest in S3.

2. Step 2: Apply strict IAM policies

   Restricting bucket access with IAM policies prevents unauthorized users from reading or modifying the state file.

3. Final Answer:

   Enable encrypt = true in the S3 backend and apply strict IAM policies limiting bucket access -> Option A

4. Quick Check:

   Encryption + access control = best practice [OK]

Hint: Combine encryption with strict access control [OK]

Common Mistakes:

• Disabling encryption but leaving bucket open
• Relying on local state without access controls
• Allowing broad bucket access despite encryption