# OpenTofu: encrypt state and plans with the encryption block

## Why

Terraform state routinely contains secrets: database passwords, private keys, tokens. Backend-side encryption at rest helps, but anyone with bucket read access sees plaintext. OpenTofu's `encryption` block encrypts state and plan files client-side before they leave the machine.

## How

In the `terraform` block:

```
terraform {
  encryption {
    key_provider "pbkdf2" "mykey" {
      passphrase = "correct horse battery staple"
    }
    method "aes_gcm" "mymethod" {
      keys = key_provider.pbkdf2.mykey
    }
    state {
      method = method.aes_gcm.mymethod
    }
    plan {
      method = method.aes_gcm.mymethod
    }
  }
}
```

The key provider derives the key (PBKDF2 from a passphrase here; other providers exist for KMS-style setups). The method defines the cipher (AES-GCM). The `state` and `plan` blocks say what gets encrypted with which method.

## Rules for agents

1. The passphrase is a secret. Never commit it. Supply it via env var or a key provider that reads from a secret store.
2. Encrypting state does not remove secrets already in old state snapshots or in backend version history. Rotate secrets after enabling encryption on a brownfield workspace.
3. If OpenTofu cannot decrypt (wrong passphrase, lost key provider config), the state is unreadable. Back up the unencrypted state and guard the passphrase before enabling.
4. This block is OpenTofu-only. A config with an `encryption` block will not parse under Terraform CLI.