What it means
Infrastructure-as-code state security protects the files, backends, locks, credentials, and metadata used to compare declared infrastructure with real resources and plan changes.
Why it matters
State can contain resource identifiers and secrets while also controlling future changes; compromise or corruption can reveal infrastructure and direct unsafe deployment actions.
Practical focus
- Define the state backends and automation identities used to manage infrastructure and the security outcome it must support
- Apply encrypted remote state, access control, locking, secret avoidance, and versioned change review through documented, reviewable configuration
- Verify state access, drift results, plan output, lock failures, and backend changes after changes and on a scheduled basis
- Plan for state loss, concurrent changes, or sensitive values being exposed, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating state loss, concurrent changes, or sensitive values being exposed as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: