# Secure your terraform.state file with Terraform Vault Backend

DevFeed: [Secure your terraform.state file with Terraform Vault Backend](<https://devfeed.tech/articles/secure-your-terraform-state-file-with-terraform-vault-backend-28871.md>)

Original publisher: [Read original article](<https://medium.com/volvo-cars-engineering/secure-your-terraform-state-file-with-terraform-vault-backend-1096aadafc74?source=rss----4eed8113139---4>)

Author: Zalan Blenessy

Published: 2024-10-29T08:45:07Z

Content type: tutorial

Language: en

Sources: [Volvo Cars Engineering - Medium](<https://devfeed.tech/sources/volvo-cars-engineering-medium.md>)

Topics: [Terraform](<https://devfeed.tech/topics/terraform.md>), [HashiCorp Vault](<https://devfeed.tech/topics/hashicorp-vault.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [DevOps](<https://devfeed.tech/topics/devops.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [automotive-industry](<https://devfeed.tech/tags/automotive-industry.md>), [aws-s3](<https://devfeed.tech/tags/aws-s3.md>), [backend-development](<https://devfeed.tech/tags/backend-development.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [devops](<https://devfeed.tech/tags/devops.md>), [hashicorp-vault](<https://devfeed.tech/tags/hashicorp-vault.md>), [http](<https://devfeed.tech/tags/http.md>), [s3](<https://devfeed.tech/tags/s3.md>), [security](<https://devfeed.tech/tags/security.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [terraform](<https://devfeed.tech/tags/terraform.md>), [vault](<https://devfeed.tech/tags/vault.md>)

## AI overview

This article introduces the Terraform Vault Backend, a specialized Terraform HTTP backend for storing terraform.state files in HashiCorp Vault. It explains why shared remote state is needed, how Terraform state works, and why state files containing secrets may require more secure storage than ordinary blob stores such as AWS S3.

## Source excerpt

tl;dr: The Terraform Vault Backend is the missing complement to the Terraform Vault Provider. Volvo Cars has since 2017 strategically grown its software engineering organisation. Today, we have thousands of software engineers and hundreds of DevOps engineers to facilitate efficient tooling and workflows for software development and release. In my role as a CI Architect at the Complete Software Factory (CSwF) department, I am accountable for the CI/CD systems at CSwF. Most of our services are hosted in "the Cloud" and terraform is the most popular tool used by our DevOps engineers to provision Cloud infrastructure. This article introduces the Terraform Vault Backend, a specialised Terraform HTTP Backend which allows you to store your terraform.state file in HashiCorp Vault. This is relevant if your terraform.state contains secrets, too sensitive to be stored in ordinary blob stores like AWS S3. Terraform is a tool that generates infrastructure from code. Given some configuration, running terraform apply makes Terraform intelligently carry out the actions needed to create the desired infrastructure. For example, you can put the following configuration in main.tf: resource "local_file" "somefile" { content = "foo bar baz" filename = "${path.module}/somefile.txt" } Then apply it with: $ terraform init $ terraform apply Out comes a file called somefile.txt with the content foo bar baz. You can inspect it with: $ cat somefile.txt foo bar baz It also creates a bunch of other files in your folder, most notably the terraform.state file. This file reflects the current state of the "infrastructure" (somefile.txt), which has been provisioned for you. Terraform is idempotent, which means that running terraform apply a second time, with the same input configuration, will not change anything as somefile.txt has already been added to terraform.state . Sharing Terraform State It is not enough to share your Terraform configuration files with your colleagues, you also need to share th