Support custom permissions mask for local state files

[gmarciani]

Terraform Version

Terraform v1.7.4
on darwin_arm64

Use Cases

As a Terraform user I want my state files containing sensitive information (eg: TLS key secrets) to be secured without being forced to upload them to a remote endpoint/bucket.

Attempted Solutions

The local backend does not provide a way to configure the permissions mask of the state files.
See https://developer.hashicorp.com/terraform/language/settings/backends/local

Proposal

Add a new attribute permissions to the local backend, accepting POSIX permissions mask.

Example:

terraform {
  backend "local" {
    path = "relative/path/to/terraform.tfstate"
    permissions = "600"
  }
}

References

No response

[crw]

Thanks for this feature request! If you are viewing this issue and would like to indicate your interest, please use the 👍 reaction on the issue description to upvote this issue. We also welcome additional use case descriptions. Thanks again!

[apparentlymart]

Hi @gmarciani,

Today's Terraform respects the process umask when creating a state file on local disk. Therefore you can control the permissions of this and all other files that Terraform creates by changing the umask to 077 before you run Terraform.

For example:

$ umask 077
$ terraform apply
$ ls -lah
total 12K
drwx------   2 mart mart 4.0K Apr  8 11:36 .
drwxrwxr-x 139 mart mart 4.0K Apr  8 11:35 ..
-rw-r--r--   1 mart mart    0 Apr  8 11:35 example.tf
-rw-------   1 mart mart  180 Apr  8 11:36 terraform.tfstate

[crw]

@gmarciani Does the above comment satisfy your use case? If so I'll close this issue, if not I will leave it open. Thanks!

[EugenKon]

.tfstate file stores secrets. Thus it should be by default 0600 permissions for that file. In other means this is the good proposition to be able to tune the file permissions.

By the way: despite on configured umask the permissions for ~/.ssh/id_rsa is stricter.

[kaden-l-nelson]

Is the above comment applicable to all platforms?