Terraform AWS Remote State S3 Backend

Abstract

1. Introduction

A terraform module to set up remote state management with S3 backend for your account. It creates an encrypted S3 bucket to store state files, which also provides S3 native state locking. Resources are defined following best practices as described in the official document and ozbillwang/terraform-best-practices.

2. Objective

A terraform module to set up remote state management with S3 backend for your account.

This project demonstrates how HCL, Terraform, AWS can be applied to a real-world Blockchain & Cloud Computing problem.

3. Key Features / Modules

• Create a S3 bucket to store remote state files.
• Encrypt state files with KMS.
• Enable bucket replication and object versioning to prevent accidental data loss.
• Automatically transit non-current versions in S3 buckets to AWS S3 Glacier to optimize the storage cost.
• Optionally you can set to expire aged non-current versions(disabled by default).
• Optionally you can set fixed S3 bucket name to be user friendly(false by default).
• Use S3 native state locking.
• Optionally create an IAM policy to allow permissions which Terraform needs.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Terraform CLI
• Cloud provider account (e.g. AWS) with CLI configured
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/nozaq/terraform-aws-remote-state-s3-backend.git
cd terraform-aws-remote-state-s3-backend

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "replica"
  region = "us-west-1"
}

module "remote_state" {
  source = "nozaq/remote-state-s3-backend/aws"

  providers = {
    aws         = aws
    aws.replica = aws.replica
  }
}

resource "aws_iam_user" "terraform" {
  name = "TerraformUser"
}

resource "aws_iam_user_policy_attachment" "remote_state_access" {
  user       = aws_iam_user.terraform.name
  policy_arn = module.remote_state.terraform_iam_policy.arn
}

terraform {
  backend "s3" {
    bucket       = "THE_NAME_OF_THE_STATE_BUCKET"
    key          = "some_environment/terraform.tfstate"
    region       = "us-east-1"
    encrypt      = true
    kms_key_id   = "THE_ID_OF_THE_KMS_KEY"
    use_lockfile = true
  }
}

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add a CI/CD pipeline with GitHub Actions
• Deploy to a public test network or cloud free tier
• Add monitoring and cost alerts

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Why does this problem need a blockchain or cloud-native design?
2. Explain the smart contract / infrastructure components and how they interact.
3. How are gas costs or cloud costs kept under control?
4. How is the system secured (keys, IAM, access control)?
5. How would the solution scale to many more users?

9. Source Code & License

This project is developed by nozaq and published on GitHub under the MIT License. Please follow the license terms and credit the original author when you use or modify this code.