Know which controls your enforces. Prove it.
Compliance.tf makes a Terraform estate provable: the controls are built into the modules, held before apply, and mapped to the clauses your auditor asks about.
- Prevention in depth.Module, plan and apply each check a change before AWS sees it.
- Every control cites its clause.Clause IDs for your auditor, enforced kept apart from mapped.
- Every exception is on the record.A reviewed line names its control; one search lists them all.
No credit card or AWS account needed.
The offer: compliance.tf for your estate on AWS
Prepared for , covering SOC 2 and CIS AWS v6.0
What waiting costs
- Every weeknew resources reach AWS without the settings your next audit will check, and each one becomes a fix later.
- Every releaseforked modules fall further behind upstream.
- Every new teamcopies whatever the repo does today, controls or not.
Start with one module today: 30 days, every framework.
Scope
Covers
- terraform-aws-modules, on every plan. Each module arrives with the controls for your frameworks built in.
- Resources written by hand outside modules, once your team switches to the compliance.tf provider: checked at plan and again before AWS creates or changes them. A violation warns by default; set to fail, it stops the change.
- For SOC 2 and CIS AWS v6.0 : the controls each framework maps to, with their clause IDs and the enforced and mapped counts in chapter 4.
Does not cover
- Mapped controls that no module enforces. They are listed in chapter 4 and never counted as enforced.
- What happens after apply. Drift and runtime findings stay with your CSPM and AWS-native tools.
- Whether your auditor accepts the mapping. That is their decision; chapter 6 lists what compliance.tf gives them.
- Azure and Google Cloud modules: planned for Q1 2027.
Prevention and detection
Compliance.tf is preventive: the setting is in the module, and hand-written resources are checked, before anything reaches AWS. Scanners, plan policy and CSPM are detective: they report after the plan or after deploy. Most programs need both, and compliance.tf replaces none of them.
| Aspect | Compliance.tf | Scanners, plan policy, CSPM |
|---|---|---|
| Acts | Before apply, in the module and the provider | After plan, or after deploy |
| A finding becomes | A setting already in place, or a run that warns or stops | A report or ticket to fix later |
| Clause IDs per control | For every framework in the catalog | Varies by tool |
| Drift and console changes | Not covered | CSPM and AWS Config |
| Resources outside Terraform | Not covered | CSPM |
| To adopt | One source line per module | A CI step or an account connection |
Keep Checkov, Trivy, OPA or Sentinel in CI. For your auditor, a setting a module enforces is a preventive control, and a scanner or AWS Config finding is evidence for a detective one; plan detective coverage for drift, console changes and resources outside Terraform.
The other way to build settings into modules is to fork them. Compliance.tf keeps pace with upstream releases, so there is no fork to merge.
Compared in detail: with Checkov and Trivy, with OPA and Sentinel.
Three points where it acts, on commands your pipeline already runs.
The modules and the provider ride on commands your team runs today. A CI check adds one step.
- Your repositoryYour code, CI and scanners stay
- terraform initModules arrive with your controls built in
- terraform planThe provider checks hand-written resources; a CI check lists each gap
- terraform applyThe provider checks again, before the AWS API call
- AWS APIReached after the checks. Under hard_fail, a violated deny control stops the run first.
The provider is a separate switch from the modules: change its source once, and its controls apply to the hand-written resources they cover.
Where it acts, before a resource is created or changed in AWS
terraform init
Modules arrive with the controls for your frameworks built in, plus your org rules when you use your org endpoint. Only the source line changes: same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "soc2. compliance. tf/terraform-aws-modules/s3-bucket/ aws" version = "~> 5.0"
Shown with the SOC 2 framework host. With an org endpoint, the source names your org host instead, and your org's frameworks and baseline come from it (chapter 5).
terraform plan
A check in your CI, in GitHub Actions or Spacelift, lists each gap and the compliance.tf module that closes it, in SARIF, JSON or Spacelift metadata. The provider in 3.3 also runs its checks at plan.
terraform apply New
The compliance.tf provider checks the resources your engineers already wrote by hand, outside modules, before AWS creates or changes them. By default a problem is a warning; set to stop, it blocks the change, and the message names the control and how to fix it.
It works with the code you have today: it runs the official AWS provider unchanged, and switching to it is a one-time change. It checks resources written by hand, not the resources inside modules.
See the message when a control is broken
Warning: [rds_db_instance_encryption_at_rest_enabled] RDS instances must have storage encryption enabled. with aws_db_instance.main, on main.tf line 12, in resource "aws_db_instance" "main": 12: storage_encrypted = false Fix: Set storage_encrypted = true. Docs: https:// compliance. tf/ docs/ controls/ aws/ rds_ db_ instance_ encryption_ at_ rest_ enabled/
By default it warns, and the change goes ahead. Message and fix from the provider's built-in controls; the resource name and line are an example.
Before AWS
Set to stop, the provider keeps a change that breaks a blocking control from reaching AWS. For your auditor, that is a preventive control at the moment of change. The message names the control and how to fix it, and can list the framework clauses it maps to. Controls that only warn let the change through, with a warning your team sees in the run.
Each control lists the clauses it maps to.
CC6.1, not "encryption". Pick a control to see its clause IDs in the frameworks you picked .
- SOC 2
- CC6.1, PI1.4
- CIS AWS v6.0
- no clause in this framework
Controls and clauses
Mapping
Each control is mapped to the clauses of every framework it supports and cited by clause ID. The framework, control and module catalogs are public: frameworks, controls.
Enforced and mapped
Modules enforce 186 of the 294 controls in the documented catalog. For the frameworks you picked :
| Framework | Enforced by modules, of mapped | Share |
|---|---|---|
| SOC 2 | 94 of 140 | |
| CIS AWS v6.0 | 18 of 26 |
Mapped but not enforced means the control is documented with its clauses and left to you.
Enforced controls are preventive: the module sets them before anything is deployed. A mapped-only control needs a control of your own; its docs page lists the clauses.
Exceptions in code
An exception is one line in a code change, naming the control it turns off. It is reviewed and approved with that change, not in a separate ticket, and a search of your repositories lists every exception where it lives.
Org rules
Operational rules are applied at download time, after the controls: an org Baseline for every module plus named rulesets. The catalog covers prevent-destroy, allowed regions, deletion protection, instance-type restriction and more. Preview a rule on a module in the Rules Playground.
One baseline from one endpoint. Each promotion logged.
Your org endpoint serves the same rules to every team that uses it. Config moves between environments as versioned snapshots, through a gate that logs each action.
your-org.
| When | Action | Snapshot |
|---|---|---|
| 09:14 | promote dev → staging | 13 |
| 11:02 | approve staging → prod | 12 |
| 11:03 | promote staging → prod | 12 |
Illustrative entries for your org.
Your organisation
Org endpoint
your-org.compliance.tf serves your baseline rules and framework attribution for every module it resolves. Teams name your project and environment in the source line; the standards come from one place.
Environments and snapshots
Projects, environments and versioned config snapshots bound to each environment, edited in the console.
Promotion gates
Config moves between environments through a governed promotion with a per-action audit log.
Members and tokens
Members, invites, access control and registry tokens, managed per organisation.
Rollout and exit
Teams adopt one module at a time and keep their pipelines, scanners and running infrastructure. Leaving is the same change in reverse: your team points the modules, and the provider if you use it, back to where they came from.
Evidence
What compliance.tf gives your auditor
- The clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment.
- The per-action audit log of promotions between environments.
What comes from your AWS account
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM, not from compliance.tf.
Full Access for every framework. Enterprise for your estate.
Full Access covers every framework in the catalog and is bought on AWS Marketplace. Enterprise is the license for your whole estate, once compliance is a requirement across the organisation. Both start with a 30-day trial.
Where is your compliance work today?
- Full Access, every framework$1,000 a year
- Enterprise, your estateCustom
Fees
Full Access $1,000 a year
Every framework in the catalog, terraform-aws-modules, the org console with team collaboration, and email support. Bought on AWS Marketplace, so the charge appears on your AWS invoice.
Enterprise custom
The estate license: custom frameworks, custom controls and priority support. Talk to us.
Term and assurances
After the trial
An unsubscribed account then moves to Free, as set out in the schedule of fees, and the org console tools lock. Deployed infrastructure is untouched.
Compliance.tf itself
- SOC 2 Type II report, in the Trust Center.
- Infrastructure in two AWS regions: us-east-1 (US) and eu-west-1 (Ireland).
- 99.9% monthly uptime for paid subscribers, under the SLA. A DPA is published.
Start with one module.
Sign up with email or Google, change one source line and re-plan.
Next step
This page is a summary. The Terms, DPA and SLA govern the trial and any purchase; this page does not.
To start
Sign up at the free trial page: 30 days, every framework. Then change one source line and re-plan.
To talk to us
For Enterprise, use the contact page. The CI check has its own setup docs.
By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.