CODEWITHSUNDEEP
amazon-s3encryptionterraform
Qwerty
Qwerty

Reputation: 227

terraform s3 remote state file auto encryption

I have a terraform backend remote state hosted on S3. I didn't set the encryption on the object level manually and didn't set anything on the S3 bucket level. My S3 bucket Default encryption is set to None

Wonder why the terraform state file is encrypted with Server-side encryption AES-256 by default?

Please advise.

Upvotes: 4

Views: 6128

Answers (2)

Vikyol
Vikyol

Reputation: 5615

Default encryption for the bucket is not enabled, but it looks like you enabled encryption for your AWS backend.

terraform {
  backend "s3" {
    bucket  = "THE_NAME_OF_THE_STATE_BUCKET"
    key     = "some_environment/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
    kms_key_id = "THE_ID_OF_THE_KMS_KEY"
  }

If kms_key_id is not specified and encrypt = true, Terraform uses SSE-S3 (AES-256) by default. As a result, the state file is encrypted with AES-256.

Upvotes: 4

Qwerty
Qwerty

Reputation: 227

sogyals429 As mentioned, the default encryption is disabled. But the object itself is encrypted.

disable default encryption enter image description here enter image description here

Upvotes: 1

Related Questions