Terraform Modules That Prevent Infrastructure Audit Findings

Those tools are detective controls - they scan infrastructure after you write it and report findings you fix manually. compliance.tf is a preventive control. The modules cannot silently produce non-compliant resources - every exception is an explicit parameter in your code, visible in review.

Most teams keep their scanners running alongside compliance.tf for defense in depth.

OPA and Sentinel are policy engines - you write rules in Rego or Sentinel language, deploy an engine, and maintain policies as your infrastructure changes. With compliance.tf, the controls are already built into the modules. You do not need to write policies or run a policy engine. Many teams use both. We handle framework-specific infrastructure controls (encryption, logging, access blocking, versioning) at the module level. OPA or Sentinel can verify organizational policies (naming conventions, tagging standards, allowed regions) across the broader stack, but they only flag violations. Custom rule authoring is in development, so those same policies will be enforced directly in the modules.

35 modules based on terraform-aws-modules, including S3, VPC, EKS, RDS, Lambda, ALB, DynamoDB, and more. Same variables, same outputs, same interface. See the full list with controls per framework.

Module versions track upstream terraform-aws-modules releases and publish usually within hours. Pin versions using Terraform's standard version argument in your module block. Ranges like ~> 4.0 work the same way as any other module.

If you need a module we do not support yet, contact us. Custom module support (BYOM) is in beta - available on Enterprise.

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

Yes. Our registry uses the standard Terraform module protocol, which OpenTofu supports natively. Run tofu login soc2.compliance.tf instead of terraform login and everything else works the same way. Terragrunt and Terramate orchestrate runs without changing how modules are resolved, so they work out of the box.

No. Terraform tracks resources by their address in state, not by the source URL. Changing the source updates where Terraform downloads the module code. Run terraform plan after switching. If your existing resources don't meet compliance controls yet (unversioned buckets, unencrypted storage), the plan will show those changes. Review the plan before applying.

We enforce controls at the Terraform module level - encryption, logging, versioning, access blocking for 35 AWS modules. You still own IAM policies, network architecture, application security, runtime monitoring, and incident response. We are transparent about this because compliance is a stack, not a single tool. We handle the infrastructure configuration layer.

Disable specific controls via a query parameter in the module source. Every exception is explicit in the source URL - the control ID appears in code, state, and plan output. Your team documents the approver and justification through your standard change process. Your audit trail shows exactly which controls were overridden - the exact documentation auditors need during exception reviews.

No. We enforce controls inside Terraform modules. Your GRC platform tracks policies, collects evidence, and manages audit workflows. We feed evidence into your GRC platform, not the other way around.

Your auditor does not need to trust compliance.tf directly. Evidence comes from AWS-native tools they already accept: AWS Config, Security Hub, and Audit Manager. We enforce controls before terraform apply, so those tools report the enforced controls as passing. We can also help you prepare downloadable control mapping matrices for your environments - the exact artifact auditors request.

Click Start Free Trial and sign in - no AWS account or credit card required. Run terraform login soc2.compliance.tf, change your module source line, and run terraform init. If you use OpenTofu, run tofu login soc2.compliance.tf instead. 35 modules with compliance controls are available today. You can also subscribe directly through AWS Marketplace.

A complete module source line looks like this:
source = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws"