Home/Templates/A safe place to keep Terraform state
A safe place to keep Terraform state
The state file holds secrets in plain text. This stores it encrypted, versioned, and locked.
Terraform
Why bother
Terraform writes the values it handled into the state file in plain text, including passwords and keys. A state bucket anyone can read is a short path from minor access to full control. It also needs locking, or two people running at once will corrupt it.
How you know it worked
Start two applies at the same time. The second should wait for the lock.
Not written yet
No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:
| Platform | Service |
|---|---|
| AWS | An S3 bucket with versioning, your own key, and native state locking |
| Azure | A storage account using blob leases for locking |
| Google Cloud | A GCS bucket with object versioning |