Plan. Apply. Comply. A blog by compliance.tf
Product updates, engineering notes, and audit-ready implementation patterns for teams building AWS infrastructure with Terraform and OpenTofu.
Get updates by email:
Three forks of terraform-aws-modules that exist to hold one lifecycle block, and the source line that replaces each of them. See the diff first in the Rules Playground, then register a free account and change one line.
See the diff an Operational Rule makes on the module root before you change a source line, pick from fifteen rules, group them into a Baseline and rulesets, and read the known Terraform limits module by module.
tfpolicy evaluates policy before Terraform downloads a module. At that stage a policy can only allow or deny a source string, which makes the catalog behind the string the thing that decides the outcome.
The compliance.tf registry is live and open to anyone. Here is why a compliance-aware Terraform registry matters, what it gives you, and how to pull your first module in about five minutes.
A practical guide to diagnosing terraform init failures against private registries using curl, HTTP headers, and the compliance.tf registry.
Introducing Operational Rules — your platform standards, enforced at terraform init. No more forking modules to add lifecycle blocks.
Compare the hidden costs of building compliance yourself on terraform-aws-modules with the built-in controls and managed maintenance that compliance.tf provides.
Learn how to validate compliance.tf modules with IaC scanners before deployment and infrastructure scanners after, what evidence auditors need, and how pre-apply and post-apply verification work together.
Replace after-the-fact Terraform scanning with modules that have built-in compliance controls, blocking non-compliant AWS infrastructure before it reaches your plan.
