Your security team scanned some Terraform workspaces and found secrets stored in plaintext in state files. How can you protect that data?

The correct answer is D. Store the state in an encrypted backend. Terraform state files can contain sensitive data (passwords, keys, connection strings) in plaintext. The best practice to protect this data is to use a remote backend that supports encryption at rest - for example, Amazon S3 with server-side encryption, Terraform Cloud (which…

Submitted by noor.lb· Apr 18, 2026Manage Terraform State

Question

Your security team scanned some Terraform workspaces and found secrets stored in plaintext in state files. How can you protect that data?

Options

AEdit your state file to scrub out the sensitive data
BAlways store your secrets in a secrets.tfvars file
CDelete the state file every time you run Terraform
DStore the state in an encrypted backend

How the community answered

(39 responses)

B
3% (1)
C
5% (2)
D
92% (36)

Explanation

Terraform state files can contain sensitive data (passwords, keys, connection strings) in plaintext. The best practice to protect this data is to use a remote backend that supports encryption at rest - for example, Amazon S3 with server-side encryption, Terraform Cloud (which encrypts state automatically), or Azure Blob Storage with encryption. Manually editing the state file (A) is fragile and re-introduced on the next apply. Storing secrets in a .tfvars file (B) still stores them in plaintext. Deleting the state file (C) would cause Terraform to lose track of all managed resources entirely.

Topics

#Terraform State#Secrets Management#State Backend Encryption#Data Protection

Community Discussion

No community discussion yet for this question.

Full TERRAFORM-ASSOCIATE-004 Practice