Terraform · Infrastructure as code

How do you secure Terraform state?

Hardstate securityencryptioniamUpdated Oct 2026

Short answer

State can contain passwords, keys and private IPs, so encrypt it at rest with KMS, restrict who can read the bucket, enable versioning and audit access. Separate production state from lower environments and never commit it.

State is a high-value target because it holds resource attributes, sometimes including generated passwords and connection strings. Treat the backend as production data: least-privilege IAM, encryption with a customer-managed key, access logging and versioning for recovery.

hcl

terraform {
  backend "s3" {
    bucket       = "acme-tfstate-prod"
    key          = "prod/terraform.tfstate"
    region       = "us-east-1"
    encrypt      = true
    kms_key_id   = "arn:aws:kms:us-east-1:111122223333:key/abcd"
    use_lockfile = true
  }
}

Server-side encryption with a customer-managed KMS key, plus versioning and bucket policy configured outside this block.

Controls to put in place

Block public access and deny unencrypted or non-TLS requests
Restrict read and write to the Terraform execution roles
Enable bucket versioning and access logging
Use a separate state bucket and key per environment and team
Rotate any secret that was ever committed to state

Sensitivity markers do not encrypt state, and state history keeps old values after a rotation. If a secret was written to state, assume it was exposed to everyone with backend read access and rotate it. Review who can run terraform state pull, because that permission effectively grants read access to every attribute.

Avoid storing state on a laptop or in a Git repository. Both bypass the backend's encryption, locking and audit controls.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

1What kinds of sensitive data can appear in state?
2Why is bucket versioning important for state?
3Who should be allowed to run terraform state pull?
4What do you do if state was committed to Git?

Say it in the interview

I treat state as sensitive production data. The backend uses a customer-managed KMS key, versioning, access logging, public-access blocks and least-privilege IAM. I separate production state from other environments and never commit it. Sensitivity flags do not encrypt state, so if a secret was ever written there, I rotate it and review who can pull state.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.

Start a free Terraform interview Browse all questions

Controls to put in place

Follow-ups you should expect

Related questions

Now say it out loud.