Terraform S3 backend without encryption or a state lock

What it checks

Terraform S3 backend without encryption or a state lock

Where it applies

Terraform: terraform

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Set encrypt = true. Create an aws_dynamodb_table for state locking, reference it via dynamodb_table = <name>.

Frameworks

• AWS Well-Architected OPS.6
• AWS Well-Architected SEC.8

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules