Terraform state files store sensitive data like passwords and API keys in plain text by default. This guide covers how to encrypt Terraform state both at rest and in transit, including configuring AWS KMS with S3 backends, and using OpenTofu's native client-side encryption feature (unavailable in Terraform OSS). OpenTofu supports an encryption block with key providers like AWS KMS, GCP KMS, and Vault, and handles both greenfield and brownfield migration scenarios. Five best practices are outlined: always enable both encryption types, implement network restrictions, limit access to state files and keys, keep sensitive data out of state using ephemeral resources, and use custom encryption keys for more control.
Table of contents
What is Terraform state file encryption?How to encrypt Terraform stateState file encryption at rest with OpenTofuCore best practices for Terraform state file encryptionHow to manage Terraform state with SpaceliftKey takeawaysFrequently asked questions1.5K Impressions1 Comment