terraform sops

.gitignore

# .tfstate files
*.tfstate
*.tfstate.*

# do not ignore encrypted tfstate files, with .enc inside
!*.enc.tfstate
!*.enc.tfstate.*

# unless it is decrypted
*.decrypted*tfstate
*.decrypted*tfstate.*

.sops.yaml

---
creation_rules:
  # I want to add regex such to keep some properties, but entire file is works for now
  - path_regex: (\.enc)?\.tfstate(\.backup)?$
    age: "age........."

terraform.sh

#!/bin/bash
sops --decrypt terraform.enc.tfstate > terraform.tfstate
terraform $@
sops --encrypt terraform.tfstate > terraform.enc.tfstate