How to secure Terraform state storage without a VPN using zero-trust networking

Terraform state files are among the most sensitive cloud artifacts, often storing secrets in plain text, yet they are commonly hosted on publicly accessible storage endpoints protected only by an access key. A two-phase bootstrap approach solves the chicken-and-egg problem of securing this storage: the first phase creates the state backend infrastructure using local state, while the second phase migrates to remote state and locks down public network access. Rather than deploying a costly VPN gateway or bastion host to allow CI pipelines and operators to reach the now-private storage, a lightweight zero-trust connector runs as a container inside the virtual network. This connector joins an identity-aware mesh, granting authenticated access to the private endpoint only for the duration needed, with no certificates to rotate or permanent infrastructure to maintain. The key pitfall to avoid is disabling public access before the private network route exists, which would cut off Terraform mid-apply before it can write state.