Red Backend

A minimal, security-first S3 remote backend for Terraform — public access blocked, versioned, encrypted, with S3 native state locking (no DynamoDB).

Requirements:

1. Terraform >= 1.15.0
2. Trivy >= 0.68.2

Trivy can be installed via Homebrew on macOS with the command:

brew install aquasecurity/trivy/trivy

Security posture

• All public access blocked; versioning always on
• SSE-S3 encryption by default, optional customer-managed KMS via kms_key_arn (IAM policy picks up the required KMS permissions automatically)
• Generated IAM policy scoped to the single state bucket, with lock-file permissions gated by object tag
• Code scanned with Trivy and gitleaks on every commit; integration-tested with Terratest against a live AWS account

Features

• Creates a versioned, encrypted S3 bucket for Terraform remote state with all public access blocked
• Uses S3 native state locking (use_lockfile) — no DynamoDB table required
• SSE-S3 encryption by default, with optional customer-managed KMS via kms_key_arn
• Generates a scoped IAM policy for state access, automatically including KMS permissions when a key is supplied
• Outputs a ready-to-copy backend "s3" configuration block
• Configurable tags applied across all resources

Usage

See examples/complete for a working configuration. The module does not configure the AWS provider — that belongs to you:

provider "aws" {
  region = "us-east-1"
}

module "backend" {
  source = "RussellGilmore/red-backend/aws"

  project_name = "my-project"
}

Requirements

Name	Version
terraform	>= 1.15.0
aws	>= 6.47.0

Providers

Name	Version
aws	>= 6.47.0

Modules

No modules.

Resources

Name	Type
aws_iam_policy.s3_ddb_policy	resource
aws_s3_bucket.backend_s3	resource
aws_s3_bucket_public_access_block.s3_public_access_block	resource
aws_s3_bucket_server_side_encryption_configuration.s3_encryption	resource
aws_s3_bucket_versioning.s3_versioning	resource
aws_caller_identity.current	data source
aws_partition.current	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
additional_tags	Additional tags to apply to all resources created by this module.	map(string)	{}	no
kms_key_arn	Optional ARN of a customer-managed KMS key for S3 server-side encryption. When empty (default), SSE-S3 (AES256) is used. When set, SSE-KMS with a bucket key is enabled and the generated IAM policy includes the KMS permissions required for state access.	string	""	no
project_name	Project name used for resource naming and the Project tag.	string	n/a	yes

Outputs

Name	Description
backend_configuration	Backend configuration block for use in other Terraform configurations
example_backend_config	Example backend configuration to copy into your terraform block
red_backend_s3_bucket	The S3 bucket for storing Terraform state files