terraform s3 remote state file auto encryption

user_6591857 0
Viewed 2315

I have a terraform backend remote state hosted on S3. I didn't set the encryption on the object level manually and didn't set anything on the S3 bucket level. My S3 bucket Default encryption is set to None

Wonder why the terraform state file is encrypted with Server-side encryption AES-256 by default?

Please advise.

terraform amazon-s3 encryption
2 Answers

Default encryption for the bucket is not enabled, but it looks like you enabled encryption for your AWS backend.

terraform {
  backend "s3" {
    bucket  = "THE_NAME_OF_THE_STATE_BUCKET"
    key     = "some_environment/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
    kms_key_id = "THE_ID_OF_THE_KMS_KEY"
  }

If kms_key_id is not specified and encrypt = true, Terraform uses SSE-S3 (AES-256) by default. As a result, the state file is encrypted with AES-256.

user_11516960

sogyals429 As mentioned, the default encryption is disabled. But the object itself is encrypted.

disable default encryption enter image description here enter image description here

user_65918570
Related