# Seal the state to a list of readers Encrypt the attributes, outputs and stored plans of a state in a bucket to a list of readers that the repository keeps, add and remove a reader, and let a CI job read. Level: intermediate · Time: 15 minutes · Needs: A state in an S3 bucket, as in [Keep the state in a shared bucket](remote-state.md), and a repository to commit to. This page uses the in-memory bucket from pravo's source. Done when: `pravo protect status` says `Readers .pravo/access/readers.txt matches the store`, and `pravo state show` fails for a user who is not a reader. A state holds the attributes of every resource: passwords, keys and tokens that a provider returned. Anyone who can read the bucket can read them. This page seals the state, so that the bucket, a backup or an old version of an object shows addresses and types and no value. A list of readers, kept in the repository, decides who can open it. > [!NOTE] > Every command below runs against `tools/fakes3`, the in-memory S3 server in pravo's source, on port 9000, and the three people are three directories on one machine. The state is created with `pravo state import-tfstate` so that the page needs no provider. Sealing stops at format 3: there are no roles and no signatures, and [what sealing protects](../concepts/sealed-state.md) says what that leaves open. ## 1. Make an identity An identity is a reader key, which opens the state, and a signing key. `pravo id new` makes both and seals the reader key under a passphrase. It touches no state, and anyone can run it at any time. On a terminal it asks for the passphrase twice. This page sets `PRAVO_PASSPHRASE` so that the command runs in a script. ```sh run mkdir -p people pravo id new --name ada ``` ```text out Identity ada created signing ssh-ed25519 SHA256: new key, kept in the identity file reader x25519: sealed with a passphrase in people/ada/id/ada Give whoever keeps .pravo/access/readers.txt this line, and nothing else: ada ssh-ed25519 x25519: ``` The identity is a file in `~/.config/pravo/id`, apart from `~/.pravo`, which is the provider cache and may be deleted. The line at the end is public. To reuse an SSH key as the signing key, add `--ssh ~/.ssh/id_ed25519`. ## 2. Have a state to seal Point the root at the bucket and give it some records. The `terraform.tfstate` below stands for a state that an earlier tool wrote, with a password in it. ```cue file=main.cue package ws $settings: state: { backend: "s3" bucket: "northwind-state" prefix: "prod" region: "eu-west-1" endpoint: "http://127.0.0.1:9000" path_style: true } ``` ```json file=terraform.tfstate hidden { "version": 4, "terraform_version": "1.13.1", "serial": 1, "lineage": "abe75052-395d-84be-f062-c43444404a1a", "outputs": {"endpoint": {"value": "db.internal", "type": "string"}}, "resources": [ {"mode": "managed", "type": "aws_db_instance", "name": "main", "provider": "provider[\"registry.opentofu.org/hashicorp/aws\"]", "instances": [{"schema_version": 0, "attributes": {"id": "db-1", "master_password": "example-password", "engine": "postgres"}, "sensitive_attributes": [], "dependencies": []}]}, {"mode": "managed", "type": "aws_vpc", "name": "main", "provider": "provider[\"registry.opentofu.org/hashicorp/aws\"]", "instances": [{"schema_version": 0, "attributes": {"id": "vpc-1", "cidr_block": "10.0.0.0/16"}, "sensitive_attributes": [], "dependencies": []}]} ] } ``` ```sh run pravo state import-tfstate terraform.tfstate ``` ```text out Imported 2 resources and 1 outputs from terraform.tfstate into s3://northwind-state/prod ``` The bucket now holds the password in plain text: ```sh run curl -s "$FAKES3_URL/northwind-state/prod/resources/aws_db_instance.main.json" | grep master_password ``` ```text out "master_password": "example-password", ``` ## 3. Write the readers file Dan and Eve run the same command on their machines and send their lines. The repository keeps the lines in `.pravo/access/readers.txt`, one for each reader. This file, reviewed like any other change, is the whole access policy: whoever can merge a change to it decides who may read. ```sh run mkdir -p .pravo/access pravo id show | tail -n 1 | sed 's/^ *//' > .pravo/access/readers.txt for p in dan eve; do PRAVO_CONFIG_DIR=people/$p pravo id new --name $p | tail -n 1 | sed 's/^ *//' >> .pravo/access/readers.txt done cat .pravo/access/readers.txt ``` ```text out ada ssh-ed25519 x25519: dan ssh-ed25519 x25519: eve ssh-ed25519 x25519: ``` Writers take the list from the checked-out repository and never from the bucket, so someone who can only write to the bucket cannot add themselves. The reference page describes [the format of the file](../reference/protect.md#the-readers-file). From here on the repository expects the state to be sealed. A command that writes a state that is not sealed stops with exit code 5 until step 5 has run, and the `Sealed` line of `pravo protect status` ends with `the repository expects a sealed state`. The same check notices a state that someone lowered to an earlier format in the bucket, and a state that does not exist yet: a command that writes stops with exit code 5 and creates nothing, `pravo protect status` says `no state yet` for it, and `pravo protect init --encrypt` creates the state sealed. The readers file covers every root below the directory that holds `.pravo`, because a command looks for it in `.pravo/access` of the root and then of each parent directory up to the one that holds `.git`. A root in the repository that is not meant to be sealed names another directory with `--access-dir` or `$PRAVO_ACCESS_DIR`, and is then not expected to be sealed. ## 4. Check that the store is ready Before it changes anything, `pravo protect check` tests the store harder than the probe that every command makes: eight writers race to replace one object and exactly one must win. It also lists what is running now. It reads and writes nothing in the state. ```sh run pravo protect check ``` ```text out Store s3://northwind-state/prod (eu-west-1) Conditional create-only ok · replace ok · delete ok 8 concurrent replaces: 1 winner · listing sees a new key at once State 2 records · format 1 · last written by pravo Readers file .pravo/access/readers.txt · 3 readers (ada dan eve) Running 0 transactions · 0 locks held Machines every writer in the last 30 days used pravo >= Ready to seal. Next: pravo protect init --encrypt ``` A store that ignores conditional writes is refused, because the records are rewritten as objects that are never overwritten, and that needs create-only writes to be real. A state in a local directory is refused too: its compare-and-swap is a lock of one user. If a command is running or a lock is held, the check says `Not ready` and exits 4. Announce a short freeze, then continue. ## 5. Seal the state `pravo protect init --encrypt` is the only step that changes the store. It shows what it will do and asks for a yes. `--yes` answers the question in a script. ```sh run pravo protect init --encrypt --yes ``` ```text out Readers .pravo/access/readers.txt (ada dan eve) This will: 1 write 2 records as immutable objects rec/ 2 encrypt their attributes and private data to 3 readers (ada dan eve) 3 seal outputs.json, stored-plan values and the values in transaction command lines the same way 4 set the state to format 3. Earlier versions of pravo will refuse it store check passed 2 records sealed in