Your security team scanned some Terraform workspaces and found secrets stored in plaintext in state files. How can you protect that data?

Terraform state files store a representation of managed infrastructure, which often includes sensitive data like passwords or private keys in plaintext. The most effective and recommended method to protect this data is to use a remote backend that supports encryption at rest. Services like Terraform Cloud, AWS S3, Azure Blob Storage, and others can be configured to automatically encrypt the state file before it is stored. This ensures that even if an unauthorized party gains access to the storage location, the sensitive data within the state file remains protected by encryption.

A. Manually editing state files is strongly discouraged. It is error-prone, can easily corrupt the state, and is not a scalable or repeatable security practice.

B. A .tfvars file is used for variable input. The values, including secrets, are still written in plaintext to the state file after being used by Terraform.

C. Deleting the state file is destructive. It causes Terraform to lose track of managed resources, leading to orphaned infrastructure or attempts to recreate existing resources.

1. HashiCorp Terraform Documentation, "Sensitive Data in State": "To protect sensitive values, you should not commit your state files to version control. Instead, we recommend storing your state in a remote backend that supports encryption at rest, like Terraform Cloud or HashiCorp Consul."

2. HashiCorp Terraform Documentation, "Backend Type: s3": The documentation for the S3 backend details the encrypt argument: "(Optional) Enable server-side encryption of the state file." This demonstrates a specific implementation of the correct answer.

3. HashiCorp Terraform Documentation, "State: Remote State": "Remote state is stored in a remote backend... Storing state remotely can provide better security. For example, backends like Terraform Cloud can encrypt the state data both in transit and at rest..."

4. HashiCorp Learn, "Manipulating Terraform State": "Manually editing the state file is risky. If you make a mistake, you can corrupt your state file and lose your infrastructure. Whenever possible, you should use the terraform state command to modify your state." This reference supports why option A is incorrect.