Use OpenTofu's native state encryption feature to encrypt Terraform state at rest with a passphrase-derived key before storing it in an S3 backend

Steps

1. Upgrade to OpenTofu 1.7 or later which introduced the encryption block in the tofu configuration; add a terraform { encryption { } } block in the root module
2. Inside the encryption block, define a key_provider block of type pbkdf2 and supply the passphrase via an environment variable reference using key_provider "pbkdf2" "main" { passphrase = var.state_passphrase }
3. Define a method block of type aes_gcm referencing the key provider, then set state { method = encryption_method.aes_gcm.main } to apply encryption to all state reads and writes
4. Store the passphrase in the CI secret store and inject it as TF_VAR_state_passphrase at plan and apply time; never hardcode it in the configuration
5. For key rotation, add a fallback block inside the state encryption config pointing to the old key provider; OpenTofu will decrypt with the fallback and re-encrypt with the primary on the next apply
6. Verify that the raw S3 object is not readable as plain JSON by downloading the state file directly from S3 and confirming it contains encrypted bytes rather than resource attributes