State file encryption in Terraform - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption for the Terraform state file in an S3 backend.

Terraform

terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "state.tfstate"
    region = "us-west-2"
    [1] = true
  }
}

Drag options to blanks, or click blank then click option'

Astate_encryption

Bencryption

Cenable_encryption

Dencrypt

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect attribute names like 'encryption' or 'enable_encryption'.

Forgetting to set the attribute to true.

The correct attribute to enable encryption in the S3 backend is encrypt. Setting it to true ensures the state file is encrypted at rest.

2fill in blank

medium

Complete the code to specify the KMS key ID for encrypting the Terraform state file in the S3 backend.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-west-2"
    encrypt        = true
    [1] = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
  }
}

Drag options to blanks, or click blank then click option'

Akms_key_id

Bkms_key

Cencryption_key

Dkey_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'kms_key' instead of 'kms_key_id'.

Using generic names like 'encryption_key' or 'key_id'.

The correct attribute to specify the KMS key for encryption in the S3 backend is kms_key_id. This tells Terraform which KMS key to use for encrypting the state file.

3fill in blank

hard

Fix the error in the backend configuration to properly enable server-side encryption with a KMS key.

Terraform

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "state.tfstate"
    region         = "us-west-2"
    encrypt        = [1]
    kms_key_id     = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
  }
}

Drag options to blanks, or click blank then click option'

A"true"

BTrue

Ctrue

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around boolean values.

Using capitalized True instead of lowercase true.

The encrypt attribute expects a boolean value true without quotes. Using quotes makes it a string, which causes an error.

4fill in blank

hard

Fill both blanks to configure the S3 backend with encryption enabled and a specific KMS key.

Terraform

terraform {
  backend "s3" {
    bucket     = "my-terraform-state"
    key        = "state.tfstate"
    region     = "us-west-2"
    [1] = true
    [2] = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
  }
}

Drag options to blanks, or click blank then click option'

Aencrypt

Bkms_key

Ckms_key_id

Dencryption

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 'kms_key' with 'kms_key_id'.

Using 'encryption' instead of 'encrypt'.

The encrypt attribute enables encryption, and kms_key_id specifies the KMS key ARN for server-side encryption.

5fill in blank

hard

Fill all three blanks to create a backend configuration that enables encryption, specifies the KMS key, and sets the region.

Terraform

terraform {
  backend "s3" {
    bucket     = "my-terraform-state"
    [1] = "us-west-2"
    encrypt    = true
    [2] = "arn:aws:kms:us-west-2:123456789012:key/abcd-1234-efgh-5678"
    [3] = "state.tfstate"
  }
}

Drag options to blanks, or click blank then click option'

Aregion

Bkms_key_id

Ckey

Dbucket

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up 'bucket' and 'key' attributes.

Using incorrect attribute names for region or KMS key.

region sets the AWS region, kms_key_id specifies the KMS key ARN, and key defines the path to the state file in the bucket.