Securely Storing Terraform State with S3 Backend and IAM Role

8 August 2024

Using Terraform’s Remote State Backend with S3 and IAM Role

When working on large-scale infrastructure deployments using Terraform, it’s crucial to manage your state files securely. One of the best practices is to use a remote state backend, such as Amazon S3, to store your Terraform state. This approach ensures that your state files are not stored locally on each machine and can be accessed by multiple team members or even automated processes.

Setting Up an IAM Role for S3 Access

Before you can utilize S3 as your Terraform remote state backend, you need to set up an IAM role that allows Terraform to access your S3 bucket. This involves creating a new IAM role with specific permissions to read and write objects in the designated bucket.

# Configure the AWS provider
provider "aws" {
  region = "your-region-here"
}
# Create a new IAM role for Terraform state backend
resource "aws_iam_role" "terraform_state_backend" {
  name        = "terraform-state-backend-role"
  description = "Role to access S3 bucket for Terraform state"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      }
    }
  ]
}
EOF
}
# Attach a policy to the IAM role for S3 access
resource "aws_iam_policy" "terraform_state_backend_access" {
  name        = "terraform-state-backend-access-policy"
  description = "Policy to access S3 bucket for Terraform state"
  policy      = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Effect": "Allow",
            "Resource": "${aws_s3_bucket.terraform_state_backend.arn}"
        }
    ]
}
EOF
}
# Attach the policy to the IAM role
resource "aws_iam_role_policy_attachment" "attach-policy-to-role" {
  role       = aws_iam_role.terraform_state_backend.name
  policy_arn = aws_iam_policy.terraform_state_backend_access.arn
}

Configuring Terraform to Use S3 as Remote State Backend

Next, you’ll configure Terraform to use your S3 bucket as the remote state backend. This involves setting up a new S3 bucket and then configuring Terraform to point to this bucket.

# Create an S3 bucket for Terraform state backend
resource "aws_s3_bucket" "terraform_state_backend" {
  bucket        = "your-bucket-name-here"
  region        = "your-region-here"
  acl            = "private"
  # Configure server-side encryption
  server_side_encryption_configuration = <<EOF
{
  "rule": [
    {
      "apply_server_side_encryption_by_default" : {
        "s3_encryption_by_key" : {
          "kms_key_arn" : "your-kms-key-arn-here"
        }
      }
    }
  ]
}
EOF
}
# Configure Terraform to use S3 as remote state backend
terraform {
  backend "s3" {
    bucket = aws_s3_bucket.terraform_state_backend.bucket
    key    = "path/to/your/state.hcl"
    region = aws_s3_bucket.terraform_state_backend.region
    # Use IAM role for authentication
    access_key = ""
    secret_key  = ""
    iam_role    = aws_iam_role.terraform_state_backend.name
    iam_role_session_name = "terraform-state-backend-session"
  }
}

This setup allows you to use Terraform’s remote state backend with Amazon S3 and an IAM role for secure infrastructure as code management. By following these steps, you can ensure that your Terraform state files are stored securely in the cloud, while also adhering to best practices for security and compliance.

Conclusion

Using a remote state backend like S3 with an IAM role is a crucial step in securing your Terraform infrastructure as code. By setting up a secure connection between Terraform and your S3 bucket, you can ensure that your sensitive data remains protected from unauthorized access. This approach also allows for easier collaboration among team members and automated processes, making it an essential part of any large-scale deployment using Terraform.

Poespas Blog