OpenTofu

Encryption Commands

OpenTofu's native state encryption feature for securing sensitive state data at rest.

4 commands

Pro Tips

OpenTofu supports native state encryption unlike Terraform OSS

Commands

Enable encryption

$ terraform { encryption { key_provider "pbkdf2" "my_passphrase" { passphrase = var.passphrase } method "aes_gcm" "my_method" { keys = key_provider.pbkdf2.my_passphrase } state { method = method.aes_gcm.my_method } } }

Configure state encryption.

AWS KMS encryption

$ key_provider "aws_kms" "my_kms" { kms_key_id = "alias/my-key" region = "us-east-1" }

Use AWS KMS for encryption.

GCP KMS encryption

$ key_provider "gcp_kms" "my_gcp" { kms_encryption_key = "projects/my-proj/locations/global/keyRings/my-ring/cryptoKeys/my-key" }

Use Google Cloud KMS for state encryption.

Plan file encryption

$ encryption { plan { method = method.aes_gcm.my_method } }

Encrypt plan files alongside state.