iac.htora.dev · security templates

Home/Templates/A safe place to keep Terraform state

A safe place to keep Terraform state

The state file holds secrets in plain text. This stores it encrypted, versioned, and locked.

Terraform

Why bother

Terraform writes the values it handled into the state file in plain text, including passwords and keys. A state bucket anyone can read is a short path from minor access to full control. It also needs locking, or two people running at once will corrupt it.

How you know it worked

Start two applies at the same time. The second should wait for the lock.

Not written yet

No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:

PlatformService
AWSAn S3 bucket with versioning, your own key, and native state locking
AzureA storage account using blob leases for locking
Google CloudA GCS bucket with object versioning

Registry 0.6.0. Built 2026-09-22.

Made by Habibullah Tora. Code under the MIT licence, writing under CC BY 4.0.