Your organization uses OpenTofu to provision cloud infrastructure. The security team has found that the local terraform.tfstate file written on each developer workstation exposes sensitive values such as passwords and cloud-resource IDs. They require that, during normal operation, no state file is persisted on individual machines, while still allowing multiple engineers to collaborate on the same configuration from their laptops. Which change best meets this requirement with minimal redesign of the existing workflow?
Add terraform.tfstate to the project's .gitignore file to prevent it from being checked in to version control.
Configure a supported remote backend (for example S3, Consul, or TACOS) and remove the default local backend so state is stored remotely.
Always run tofu plan and tofu apply with the -refresh=false flag so no state data is written locally.
Set an environment variable named TOFU_STATE_ENCRYPT=1 so OpenTofu keeps state only in encrypted memory.
Configuring a remote backend moves the state file from each workstation to a shared data store (for example, S3, Consul, TACOS, or another supported backend). When a non-local backend is used, OpenTofu keeps the working copy of state only in memory and writes it directly to the remote store; it is not saved on disk except if the backend write fails, which satisfies the security team's concern. Adding the file to .gitignore (or running with -refresh=false) does nothing to stop the file being written locally, and the environment variable shown does not exist in OpenTofu. Therefore the remote backend solution is the only option that removes local persistence while preserving normal collaboration features such as locking and shared updates.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a remote backend in OpenTofu?
Open an interactive chat with Bash
Why does OpenTofu use a state file?
Open an interactive chat with Bash
How does storing the state file remotely improve security?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Automation, Orchestration, and Scripting
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access