Decrypt Terraform States in GitLab Backend
· 4 min read
Assuming you are using the [GitLab Terraform state feature][gitlab-terraform-doc] in your self managed instance and you are using the embded [backup utility provided by GitLab][gitlab-backup-doc].
The Terraform state files are encrypted before they are stored. This means that you cannot retreiv the content at rest. For this purpose, GitLab use [application secrets][gitlab-application-secrets-doc] (and derive new secrets from thoses keys when needed) to encrypt sensitive content.
You want to retreiv the content of a state file from a GitLab backup. Like explained in [this issue][gitlab-terraform-state-offline-issue], it's not possible to easily retreiv a decrypted content is the instance is offline.