Currently, Terraform states are on-disk. They will soon contain credentials with D4206.

Could we avoid to store those credentials on disk?

• At software level. OpenTofu supports openbao as encryption backend, but Terraform doesn't
• At provider level. With Vault provider 5.0+ can use a block json_data_wo to avoid to store in the Vault, but OVH doesn't have that.
• At stanza level. Terraform suggests ephemeral blocks for that kind of use, but OVH provider doesn't support it
• null_resource + local-exec. We could replace Terraform providers logic by a script to run locally to use OVH API and Vault CLI client. Works, but the Terraform point was to avoid that (if not, we would have done everything in Salt + salt-cloud).

On FreeBSD, we got good results with PEFS on devserver role.
So could we keep states on disk, but with encryption-at-rest?