Storing state in S3

The terraform_s3_backend role creates:

• a private S3 bucket with versioning and default encryption, named by terraform_s3_backend_bucket_name, in terraform_s3_backend_region (or the AWS profile’s region)

• a KMS key for encrypting secrets with SOPS, unless terraform_s3_backend_sops_kms_key_create_enabled is false; its ARN is stored in terraform_s3_backend_sops_kms_key_arn

The state is locked with an S3 lock file (use_lockfile), which needs Terraform 1.10 or later, or OpenTofu. For older versions of Terraform, set terraform_s3_backend_use_lockfile to false and the role creates a DynamoDB table for locking instead.

The backend configuration is registered in terraform_s3_backend_config. It does not include a key, so add one for each module, so that each module keeps its own state object in the bucket.

Note

The role does not create any IAM roles or policies. It assumes that the state is kept in the same AWS account as the infrastructure it describes, and that you are using an account with administrator access. To keep state for several projects in one account, use per-project IAM roles to control access to it.