How can you protect sensitive data stored in Terraform state files?

How can you protect sensitive data stored in Terraform state files?

• A. Delete the state file every time you run Terraform
• B. Store the state in an encrypted backend
• C. Edit your state file to scrub out the sensitive data
• D. Always store your secrets in a secrets.tfvars file

Answer: (B)

Protecting sensitive data stored in Terraform state relies on encrypting the state at rest and enforcing access controls through a supported backend. When state contains credentials, tokens, or other secrets, storing it in an encrypted backend ensures the data is unreadable if the storage is compromised and that only authorized users or services can read or modify it. This centralizes and secures the state, reducing the risk of leaks. That’s why using an encrypted backend is the best answer: it provides built-in protection for the state file and integrates with authentication and key management, so you don’t have to rely on manual scrubbing or ad-hoc files. Deleting the state after every run isn’t a viable protection strategy and would break Terraform’s ability to map resources. Editing the state to scrub data is risky and can corrupt the state. Storing secrets in a separate tfvars file doesn’t secure the state itself, and those secrets could still be exposed or end up in the state if used to configure resources.

Protecting sensitive data stored in Terraform state relies on encrypting the state at rest and enforcing access controls through a supported backend. When state contains credentials, tokens, or other secrets, storing it in an encrypted backend ensures the data is unreadable if the storage is compromised and that only authorized users or services can read or modify it. This centralizes and secures the state, reducing the risk of leaks.

That’s why using an encrypted backend is the best answer: it provides built-in protection for the state file and integrates with authentication and key management, so you don’t have to rely on manual scrubbing or ad-hoc files. Deleting the state after every run isn’t a viable protection strategy and would break Terraform’s ability to map resources. Editing the state to scrub data is risky and can corrupt the state. Storing secrets in a separate tfvars file doesn’t secure the state itself, and those secrets could still be exposed or end up in the state if used to configure resources.