nerdexam
HashiCorp

TA-002-P · Question #71

Your security team scanned some Terraform workspaces and found secrets stored in a plaintext in state files. How can you protect sensitive data stored in Terraform state files?

The correct answer is B. Store the state in an encrypted backend. To protect sensitive data found in plaintext within Terraform state files, the recommended approach is to use a remote backend that encrypts the state at rest.

Implement and maintain state

Question

Your security team scanned some Terraform workspaces and found secrets stored in a plaintext in state files. How can you protect sensitive data stored in Terraform state files?

Options

  • ADelete the state file every time you run Terraform
  • BStore the state in an encrypted backend
  • CEdit your state file to scrub out the sensitive data
  • DAlways store your secrets in a secrets.tfvars file.

How the community answered

(64 responses)
  • A
    2% (1)
  • B
    92% (59)
  • C
    2% (1)
  • D
    5% (3)

Why each option

To protect sensitive data found in plaintext within Terraform state files, the recommended approach is to use a remote backend that encrypts the state at rest.

ADelete the state file every time you run Terraform

Deleting the state file after every run would lead to loss of managed infrastructure tracking, preventing future updates or destruction of resources by Terraform.

BStore the state in an encrypted backendCorrect

Storing Terraform state in an encrypted backend, such as Amazon S3 with server-side encryption, Azure Storage Accounts with encryption, or Terraform Cloud, ensures that the sensitive data within the state file is encrypted when stored. This protects it from unauthorized access while at rest.

CEdit your state file to scrub out the sensitive data

Manually editing state files to remove sensitive data is error-prone, unsupported, and risks corrupting the state, which can lead to infrastructure drift or data loss.

DAlways store your secrets in a secrets.tfvars file.

Storing secrets in a `secrets.tfvars` file, if it's plaintext and committed to version control, does not prevent those secrets from being written into the state file during a Terraform run once they are processed.

Concept tested: Securing Terraform state files

Source: https://developer.hashicorp.com/terraform/language/state/backends#encryption

Topics

#Terraform state#State file security#Encrypted backends#Sensitive data

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full TA-002-P Practice