CIS Compliant Terraform Modules
Enforced Before terraform apply

Level 1 and Level 2 Benchmark recommendations for AWS, enforced at the module level. Identity controls, logging, monitoring, and storage security in every Terraform resource.

CIS Benchmarks are a prescriptive baseline when you want concrete security recommendations without a specific industry mandate. Many teams start here and map upward to SOC 2 or NIST when audits come.

123

Controls

62

Recommendations

34

AWS Modules

No credit card or AWS account needed to start.

From the team behind terraform-aws-modules. 2B+ provisions worldwide.

General · IAM · CloudWatch Logs · CloudTrail · VPC · RDSSOC 2 Type II CertifiedAvailable on AWS Marketplace

Three Steps to CIS Compliant Infrastructure

For terraform-aws-modules users, migration is a one-line change. Same workflow, same interface. Bringing your own modules? We can make those compliant too. Join the beta.

1

Change One Line

main.tf
module "s3" {
- source = "registry.terraform.io/..."
+ source = "cis.compliance.tf/..."
 
  bucket = "awesome-docs"
}
2

Run Terraform Commands

terminal
$ terraform init
Initializing modules...
- module.s3 in cis.compliance.tf/...
Terraform has been successfully initialized!
$ terraform apply
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
3

Compliance Enforced

2.1.1 · S3 Default Encryption
2.1.2 · S3 SSL Requests Only
2.1.4 · S3 Public Access Blocked
3.1 · CloudTrail Enabled
3.4 · CloudTrail Log Validation
3.7 · CloudTrail KMS Encryption
2.2 · Security Contact Registered
2.4 · Root MFA Enabled

Every compliance requirement you define is enforced automatically. Nothing to scan, nothing to remediate.

Controls Enforced for CIS

123 controls across 62 recommendations and AWS services

Enforced (13)Detected (50)
  • 2.1 Maintain current contact details
  • 2.20 Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

Additional Controls

60 additional controls enforced for CIS

Enforced (0)Detected (60)

CIS Scope: What We Handle vs. What You Own

compliance.tf handles the infrastructure configuration layer for CIS. Here is what it covers and what stays with your team.

compliance.tf Enforces for CIS

  • CIS Benchmark Level 1 and Level 2 infrastructure controls
  • CIS AWS Foundations Benchmark v6.0 recommendation mapping
  • Deployment-time evidence generation via AWS-native tools
  • Upstream module updates (terraform-aws-modules kept in sync)
  • Exception management with audit trail
  • Control documentation and benchmark mapping matrices

Your Team Still Handles for CIS

  • Network monitoring and VPC flow log analysis
  • Malware defense and endpoint protection
  • Data recovery testing and validation procedures
  • Security awareness and skills training
  • Audit log monitoring and alerting configuration
  • Account and identity management policies
  • Penetration testing and vulnerability assessments

compliance.tf enforces the CIS Benchmark recommendations that map to AWS resource configuration. Operational recommendations around monitoring, alerting, and access review processes remain your team's responsibility.

CIS Audit Evidence, Generated Automatically

Your auditor does not need to trust compliance.tf. Evidence comes from AWS-native tools they already accept.

Evidence your auditor already trusts

Every compliance.tf module enforces controls at deploy time. When AWS Config, Security Hub, or Audit Manager evaluates your resources, they report clean findings because the controls are built into the modules, not bolted on after the fact.

  • AWS Config rules validate resource configuration continuously
  • Security Hub aggregates findings across accounts and regions
  • Audit Manager generates assessment reports mapped to CIS
  • Downloadable control mapping matrices for your auditor
evidence.json
{
  "framework": "CIS",
  "clause": "2.1.1",
  "control": "s3_bucket_default_encryption_enabled",
  "status": "COMPLIANT",
  "source": "AWS Config",
  "resource": "arn:aws:s3:::awesome-docs",
  "evaluated": "2026-03-04T10:30:00Z"
}

Prevention vs. Detection for CIS

compliance.tf prevents non-compliant deployments. Scanning tools detect them after the fact. Most mature programs use both.

DimensionIaC Scanning
Checkov / Trivy / Prowler
compliance.tf
Prevents non-compliant configs before terraform applyNo (post-plan scan)Yes
Maps controls to framework clause IDsPartialYes
Produces auditor-accepted evidence (AWS-native)Scan reports onlyYes
Exception management with audit trailSuppression rulesYes
Same interface as terraform-aws-modulesN/AYes
Keeps pace with upstream module updatesN/AYes
Catches runtime drift / console changesYesNo
Covers non-Terraform resourcesYesNo
Internal engineering timeMediumLow

We recommend keeping scanning tools active alongside compliance.tf for defense in depth. The scanner validates what compliance.tf already enforces.

CIS Compliance Questions

Which CIS Benchmark version is supported?

compliance.tf maps controls to CIS Amazon Web Services Foundations Benchmark v6.0, the latest version. We also maintain mappings for v5.0 and v1.4.0 for teams that reference older benchmark versions. The module registry subdomain cis.compliance.tf serves the v1.4.0 mappings by default; use cisv600.compliance.tf for v6.0-specific modules.

Does this cover Level 1 and Level 2?

Yes, compliance.tf enforces both Level 1 (essential security) and Level 2 (defense-in-depth) recommendations where they map to infrastructure configuration. Some Level 2 recommendations are operational (monitoring review processes, log analysis) and remain your team's responsibility.

How is this different from Checkov, Trivy, or Prowler?

Those tools are detective controls. They scan infrastructure after you write it and report findings you fix manually. compliance.tf is a preventive control. The modules themselves cannot produce non-compliant resources. There is nothing to scan, nothing to remediate. Most teams keep their scanners running alongside compliance.tf for defense in depth.

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes — you’re only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

Will my auditor accept this as evidence?

Your auditor does not need to trust compliance.tf directly. Evidence comes from AWS-native tools they already accept: AWS Config, Security Hub, and Audit Manager. We enforce controls at deploy time so those AWS tools always report clean findings.

What if I want to switch back or compliance.tf shuts down?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for its upstream terraform-aws-modules equivalent with the same variables and outputs. Change your module source line back, run terraform init. Your infrastructure does not change. No lock-in, no proprietary state.

Start Deploying CIS-Compliant Infrastructure

$100/year for all 34 modules, all frameworks. 30-day free trial.

No credit card required. Switch back at any time.

Stay Informed About New Features

Join the mailing list for releases, new modules, and roadmap updates. No spam. Unsubscribe anytime.

Not convinced yet or dying for a feature we don't have? Send us an email — we really want to hear your feedback!