OpenTofu v1.7: Enhanced Security with State File Encryption
Tags: terraform, opentofu, devops, security
Published: 2024-05-06 14:29:53

Since the [stable release](https://www.env0.com/blog/celebrating-opentofu-ga-with-our-new-ci-testing-feature) in January, the OpenTofu community and the core team have been collaborating closely on the next wave of improvements. Now OpenTofu v1.7 is here, and it brings with it multiple new upgrades, with highlights like:

*   State file encryption (!)
*   Loopable import blocks
*   Removed block
*   Provider-defined functions

and [more](https://github.com/opentofu/opentofu/blob/ba4c3a5b462129cd61644a3ae760d746dc12b8fc/CHANGELOG.md).

Exciting times! Let’s dive right in.

Finally Here: State File Encryption
-----------------------------------

The launch of OpenTofu 1.7 brings a highly anticipated update: state file encryption. This addition, among the [first requested](https://github.com/opentofu/opentofu/issues/297) features by the OpenTofu community, now provides users with a critical security capability that has been eagerly awaited for years.

With state encryption, OpenTofu will encrypt the state data at rest. This ensures that, in case of unauthorized access, sensitive information, including passwords, user tokens, and private keys, will not be exposed in plaintext.

For additional context about the importance of state file encryption, and state file security in general, check out this excellent post by Daniel Grzelak: “[Hacking Terraform State for Privilege Escalation](https://blog.plerion.com/hacking-terraform-state-privilege-escalation/)”. 

We also recently had the pleasure of hosting Daniel on [The IaC Podcast](https://www.theiacpodcast.com/), which you can listen to here:

‍{% embed https://youtu.be/bxuOW6K0jIU %}

How to Configure State File Encryption
--------------------------------------

To enable and configure state file encryption, OpenTofu users will need to add an _encryption_ block to their code (or use `TF_ENCRYPTION` variable) and specify the following:

* `key_provider`, which specifies the provider for the encryption key. At the time of the release, the supported providers include PBKDF2, AWS KMS, GCP KMS, and OpenBao.

* `method` that determines the encryption method to be used. Currently, the primary supported option is AES-GCM, allowing the use of 16, 24, or 32-byte keys.

Here is an example of how this may look:

    terraform {
      encryption {
        key_provider "aws_kms" "basic" {
          kms_key_id = "a4f791e1-0d46-4c8e-b489-917e0bec05ef"
          region = "us-east-1"
          key_spec = "AES_256"
        }
      }
    
       method "aes_gcm" "method" {
         keys = key_provider.aws_kms.basic
       }
     }
    ...
    

State encryption can be implemented in both new and existing projects, and users also have the option to define a fallback configuration, facilitating automatic rollover. Furthermore, this feature enables the encryption of remote state files.

To learn more [visit OpenTofu official docs](https://opentofu.org/docs/language/state/encryption/) 

> Importantly, by delivering the feature as an opt-in, we ensure that [OpenTofu](https://www.env0.com/blog/opentofu-the-open-source-terraform-alternative) remains interoperable with Terraform v1.5, enabling it to continue to act as a [drop-in replacement](https://opentofu.org/docs/intro/migration/). 

Other Improvements
------------------

In addition to state encryption, OpenTofu v1.7 introduces several other new features, which boost efficiency through added flexibility and new automation options.

There include:

### Loopable Import Blocks with for\_each

OpenTofu 1.7 introduces support for the _for\_each_ statement within import blocks. This allows developers to import multiple instances of a resource in a single block, making it easier to handle bulk operations.

For example:

    import {
      to = random_id.test_id[tonumber(each.key)]
      id = each.value
      for_each = {
        for idx, item in var.server_ids: idx => item
      }
    }
    

[Click here to learn more](https://opentofu.org/docs/language/import/#importing-multiple-resources)‍

### Removed Block

OpenTofu now supports a _removed_ block, enabling users to tag resources for removal without destroying the corresponding infrastructure object.

[Click here to learn more](https://opentofu.org/docs/language/resources/syntax/#removing-resources)

### Provider-defined Functions

The v1.7 release incorporates support for provider-defined functions, including functions that can be dynamically defined based on your OpenTofu configurations.

[Click here to learn more](https://opentofu.org/docs/language/functions/#provider-defined-functions)

What’s Next? You Decide
-----------------------

As we announce the v1.7 release, we are already setting our sights on the [next OpenTofu version](https://github.com/opentofu/opentofu/milestone/7). 

If you have a feature you would like to see in the next version, please don't hesitate to [open an issue](https://github.com/opentofu/opentofu/issues/new/choose) or [reach out to us on Slack.](https://opentofucommunity.slack.com/join/shared_invite/zt-2hhw3bo2f-3yDLch0SBu93wNulf6z2pQ#/shared-invite/email)