terraform s3 remote state file auto encryption

Question

I have a terraform backend remote state hosted on S3. I didn't set the encryption on the object level manually and didn't set anything on the S3 bucket level. My S3 bucket Default encryption is set to None

Wonder why the terraform state file is encrypted with Server-side encryption AES-256 by default?

Please advise.

Answer 1

Default encryption for the bucket is not enabled, but it looks like you enabled encryption for your AWS backend.

terraform {
  backend "s3" {
    bucket  = "THE_NAME_OF_THE_STATE_BUCKET"
    key     = "some_environment/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
    kms_key_id = "THE_ID_OF_THE_KMS_KEY"
  }

If kms_key_id is not specified and encrypt = true, Terraform uses SSE-S3 (AES-256) by default. As a result, the state file is encrypted with AES-256.