Which practice best protects sensitive values in Terraform state files?

Which practice best protects sensitive values in Terraform state files?

• A. Enhanced remote backends
• B. Blockchain
• C. SSL
• D. Signed Terraform providers

Answer: (A)

State files can contain credentials and secret IDs, so protecting them requires storing the state in a secure, encrypted remote backend. Enhanced remote backends centralize the state and provide encryption at rest along with access controls, which prevents unauthorized reading even if someone gains access to the storage location. They often offer additional protections like versioning and locking, further reducing the risk of exposing sensitive values. SSL/TLS protects data in transit, but encryption at rest inside the backend is what keeps the sensitive values safe when the state is stored. The other options don’t address protecting the contents of the state file.

State files can contain credentials and secret IDs, so protecting them requires storing the state in a secure, encrypted remote backend. Enhanced remote backends centralize the state and provide encryption at rest along with access controls, which prevents unauthorized reading even if someone gains access to the storage location. They often offer additional protections like versioning and locking, further reducing the risk of exposing sensitive values. SSL/TLS protects data in transit, but encryption at rest inside the backend is what keeps the sensitive values safe when the state is stored. The other options don’t address protecting the contents of the state file.