auditing-terraform-state-and-backend-trust

name	auditing-terraform-state-and-backend-trust
description	Audit infrastructure-state storage and its backend for exposure and tampering: a state file holding plaintext secrets in a backend readable by too many principals, a state bucket or backend without encryption, versioning, or access scoping, a missing or unenforced state lock that allows concurrent corrupting writes, and a backend configuration that lets an attacker redirect state to a location they control. Covers Terraform and similar tools where the state file records real resource attributes and often secret values, and where whoever can read or write state can read those secrets or subvert the next apply. Use when infrastructure state is stored in a shared backend and that backend is the boundary. The principal who can read or write state is the source, the state store is the sink, and the exposed secret or the tamperable state is the bug.
license	MIT

Auditing Terraform state and backend trust: when the state file is the crown jewels

Infrastructure state is not a build artifact; it is a live record of every resource and, very often, the plaintext of the secrets those resources were created with, database passwords, generated keys, tokens. It also drives the next apply: whatever the state says exists is what the tool reconciles against. That makes the state backend a high-value target on two axes. Anyone who can read the state file can read the secrets in it, so a backend readable by too many principals is a secret-disclosure bug. Anyone who can write or redirect the state can corrupt the next apply or point it at resources they control, so a missing lock or a mutable backend configuration is a tampering bug. You audit these by checking who can read the state, how it is protected at rest, and whether writes are locked and the backend is fixed.

When to use

• Infrastructure state is stored in a shared backend such as an object store or a remote state service.