Terraform state security practices
Overview
Terraform state holds secrets and full resource addresses. Leaked state files equal game over for many environments.
Practices
- Remote state in S3+DynamoDB locking, Azure Storage with immutability, or Terraform Cloud with RBAC—never committed to Git.
- Encryption at rest with customer-managed keys for regulated clients; versioning on state buckets.
- State access limited to pipeline SPs and break-glass admins; MFA and IP allow lists where feasible.
- Sensitive outputs: mark
sensitive = true; prefer referencing secrets from Key Vault/SSM instead of storing in state.
Pipelines
Plan on PR, apply from main with approvals; drift detection schedule weekly for long-lived clients.
Recovery
Document state recovery procedure if corruption occurs; test restore from versioned backup once a year.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...