Dev Tools · 13h ago
OpenTofu Adds Native State Encryption, Closing Terraform Security Gap
OpenTofu now supports native encryption for state and plan files, protecting secrets like database passwords and API tokens at rest. The encryption operates at the data layer before files reach backends or local storage, unlike Terraform which lacks this feature. Users can enable AES-GCM encryption via a passphrase-based key provider in the terraform configuration block.
Meridian48 take
While OpenTofu's encryption is a meaningful security improvement, its reliance on a passphrase variable still requires careful key management to avoid trading one risk for another.
Read the full reporting
State Encryption in OpenTofu: How It Works and How to Roll It Out →
DEV Community
opentofuinfrastructure-as-code