Store remote state in vault

[sheerun]

Hey,

My terraform state contains pretty sensitive information so I wonder if it's possible to save remove state in vault, or in some other encrypted way. Except for Atlas push, of course.

So question: are there plans for vault remote state backend (http api or so), and is it possible to enable client-side encryption for any remote state backend in some way?

[phinze]

Hi @sheerun - good question!

We definitely have plans to support remote state encryption via Vault. Not quite sure on the timeline for that functionality, though.

In the meantime, the s3 backend does support S3's encryption-at-rest feature.

[sheerun]

To be clear: most beneficial would be client-side encryption for any backend. Is it possible to implement?

[mtougeron]

@sheerun there's been a lot of discussion about this in issue #516

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.