Handling Sensitive Data
When you deal with creating and managing cloud resources using Terraform, there could be situations where you will be working with sensitive data such as admin credentials, database user passwords, vault keys, and so on. So, it is very important that you secure the sensitive data, so it is not exposed to the outside world.
The sensitive data is stored in the state file as well, since it must record all the relevant attributes of the provisioned resources to track whether there are any changes made subsequently. So, the state file with the sensitive data is important, and you need a proper strategy to decide where it was stored and accessed.
However, a couple of considerations must be made:
- When the state file is stored with the default
localbackend, the data is stored in plain text format. - When the state file is stored in a remote backend such as S3, it can be configured to enable encryption at rest so the data will be decrypted and used only...
