| --- | |
| description: Sensitive data in OpenTofu state. | |
| --- | |
| # Sensitive Data in State | |
| OpenTofu state can contain sensitive data, depending on the resources in use | |
| and your definition of "sensitive." The state contains resource IDs and all | |
| resource attributes. For resources such as databases, this may contain initial | |
| passwords. | |
| When using local state, state is stored in plain-text JSON files. | |
| When using [remote state](../../language/state/remote.mdx), state is only ever held in | |
| memory when used by OpenTofu. It may be encrypted at rest, but this depends on | |
| the specific remote state backend. | |
| ## Recommendations | |
| If you manage any sensitive data with OpenTofu (like database passwords, user | |
| passwords, or private keys), treat the state itself as sensitive data. | |
| Storing state remotely can provide better security. | |
| OpenTofu does not persist state to the local disk when remote state is in use, | |
| and some backends can be configured to encrypt the state data at rest. | |
| For example: | |
| - The S3 backend supports encryption at rest when the `encrypt` option is | |
| enabled. IAM policies and logging can be used to identify any invalid access. | |
| Requests for the state go over a TLS connection. |