OpenTofu encrypts state and plans with OVHcloud KMS managed keys

OVHcloud has released an external key provider that connects OpenTofu to its KMS (Key Management Service), for encrypting the state and plan files used by those managing infrastructure with Infrastructure as Code. This affects users who run OVHcloud for provisioning VPS, bare metal or public cloud and want to avoid having credentials and infrastructure metadata in plain text in the state file.

How it works

The integration arrives through the external key provider of OpenTofu for OVHcloud KMS, maintained by OVHcloud, which allows using managed encryption keys to protect the state of the infrastructure. The provider is installed with a script separate from the OpenTofu binary and requires, on OVHcloud's side, an OKMS domain, an AES-type Service Key with "Wrap/Unwrap" usage, and a local IAM user for authentication.

Among the prerequisites, the OpenTofu CLI explicitly appears in version 1.13 or higher, the version in which external key providers are no longer experimental. The provider supports both token authentication and mutual TLS.

In practice, the terraform.tfstate file after activation no longer contains plain text values but an encrypted_data blob, with the encryption key regenerated on each execution: a new ephemeral data key is created and wrapped by the OVHcloud Service Key on each tofu plan or tofu apply.

The limitations, stated by OVHcloud itself

It's worth recalling them because they're often taken for granted: encryption protects data at rest, but doesn't replace state backup and versioning, doesn't prevent data corruption or replay attacks on older state or plan files, and doesn't prevent whoever runs the tofu command from reading sensitive values, because they must be able to access the decrypted state. If the key is lost, the encrypted state becomes unrecoverable.

How much the underlying KMS costs

The integration itself has no additional cost, but consumes OVHcloud's KMS service, which has a separate pricing: each key created and maintained on the software KMS costs $0.07 per month with unlimited API calls, whilst the hardware-backed version on HSM costs $1 per month per key, again with unlimited calls. Keys managed directly by OVHcloud (OMK) remain free.

Anyone wishing to try the integration can install the provider using the setup script indicated in the OVHcloud guide and report issues through the project's GitHub repository.