4 ms·
Why not store your remote state in S3 buckets? They support encryption at rest.
by varikin 10y ago
Why not store your remote state in S3 buckets? They support encryption at rest.
- JoshTriplett 10y agoThen you need a different secret in the application: the key to the data in the S3 buckets. Ultimately, you have to supply at least one secret to the application at runtime, and then it can bootstrap its way to others if needed.
- jonesetc 10y agoAll you need are the same IAM secrets that you already needed for terraform. Keeping the state out of repos and in encrypted buckets is definitely the way to go.
- eamann 10y agoS3's "encryption at rest" is transparent (see: http://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html http://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-enc...). If someone (or some server) has access to the S3 bucket, they have access to all of the data. Control then is delegated to IAM roles and permissions, not to the crypto model. > As long as you authenticate your request and you have access permissions, there is no difference in the way you access encrypted or unencrypted objects. The only advantage of S3 encryption is that if someone walks out of the data center with a disk, they can't read the data on it.