Question

Your team stores Terraform state in an S3 backend. A security review flags that the state file contains database passwords and TLS private keys in plaintext. Aside from restricting IAM access, which additional measure best protects this sensitive data at rest in the S3 backend?

Accepted Answer

Enable server-side encryption on the S3 bucket (and set encrypt = true in the backend configuration)

Answer

Add the sensitive = true argument to the affected resource blocks so the values are removed from state

Answer

Run terraform state rm on the sensitive resources so their attributes are no longer persisted

Answer

Store the state file in a private Git repository instead of S3