🚨 OpenTofu Error: 'Invalid encryption configuration' — Cause, Fix, and Troubleshooting Guide

Overview

OpenTofu’s native state encryption is configured in a terraform { encryption { ... } } block that wires key providers to methods to targets (state/plan). If that wiring is malformed — a method references a key provider that isn’t defined, a required field is missing, or an unknown key provider type is used — OpenTofu rejects the encryption configuration up front:

Error: Invalid encryption configuration

  on encryption.tf line 6, in terraform:
   6:   encryption {

Method "aes_gcm.default" refers to key provider "pbkdf2.main" which is not
defined. Define the key provider before referencing it from a method.

Symptoms

• Every tofu command fails with Invalid encryption configuration.
• The detail names a missing/undefined key provider, method, or field.
• Appears right after adding or editing the encryption block.
• Distinct from decryption failed — this is a config error, not a key mismatch.

Common Root Causes

• Method references an undefined key provider — name typo or wrong order.
• Missing required field — e.g., passphrase on pbkdf2, or kms_key_id on the AWS KMS provider.
• Unknown key provider / method type — misspelled aes_gcm or an unsupported provider.
• Target references a nonexistent method — state { method = method.aes_gcm.typo }.
• Malformed HCL in the encryption block.

How to diagnose

Read the specific wiring problem from the detail line, then inspect the block:

tofu validate 2>&1 | sed -n '1,15p'
grep -nA14 'encryption' *.tf

Confirm every referenced name is defined (key providers before methods, methods before targets):

grep -nE 'key_provider|method|state|plan' encryption.tf

Fixes

Define key providers before methods, and reference exact names:

terraform {
  encryption {
    key_provider "pbkdf2" "main" {
      passphrase = var.state_passphrase
    }
    method "aes_gcm" "default" {
      keys = key_provider.pbkdf2.main
    }
    state {
      method = method.aes_gcm.default
    }
    plan {
      method = method.aes_gcm.default
    }
  }
}

Supply required fields for the chosen key provider. AWS KMS example:

key_provider "aws_kms" "main" {
  kms_key_id = "alias/tofu-state"
  region     = "us-east-1"
  key_spec   = "AES_256"
}

Fix name typos so method and target references resolve to defined blocks.

Re-validate:

tofu validate

What to watch out for

• Order and names matter: key providers must exist before methods reference them, methods before state/plan targets.
• Each key provider has its own required fields — pbkdf2 needs a passphrase, aws_kms needs kms_key_id and key_spec.
• Encrypt both state and plan targets; a saved plan file also contains sensitive values.
• This error blocks all commands, so validate encryption changes in isolation before committing.

Related

• OpenTofu Error: ‘decryption failed’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Unsuitable value type’ — Cause, Fix, and Troubleshooting Guide
• Encrypting Terraform State at the Source with OpenTofu State Encryption