Reference analyzers

ctfkit by compliance.tf ships a set of reference analyzers. Each one emits findings under stable rule IDs, at a fixed level, at one or more stages. This page lists every rule ID in v0.2.1, what makes it fire, and where it stops, so you can decide which findings to act on and which to leave to the tools you already run.

It is for platform engineers deciding which findings to enforce, and for anyone writing an OPA policy or an exception against a rule ID.

Rules at a glance

Module source coverage

Checks whether modules and resources come from compliance.tf, and names the compliance.tf module that replaces them. Runs at pre_plan and post_plan under the same rule ID.

Limits:

• Only module calls in the root module are checked.
• Local paths, git:: and s3:: sources, archive URLs and sources on a compliance.tf host stay silent. A compliance.tf source with ?disable= belongs to the disabled-control family, so it is not reported twice.
• A host counts as compliance.tf when it is listed in allowed_endpoints in the settings file. Without that key, any host ending in .compliance.tf counts, including your organization's host such as bobthecorp.compliance.tf. With the key, list your organization's host too.
• The embedded catalog in v0.2.1 maps two resource types to a compliance.tf module: aws_s3_bucket to terraform-aws-modules/s3-bucket/aws (~> 5.0) and aws_sqs_queue to terraform-aws-modules/sqs/aws (~> 4.0). Other raw resources are not reported by this rule. Resources already inside a compliance.tf module are skipped.
• The suggested host comes from --remediation-host (default soc_2, giving soc2.compliance.tf). It is always a framework host; see Hosts and registry tokens.

Disabled controls

Checks for controls switched off on a compliance.tf module source. Runs at pre_plan.

module "s3_bucket" {
  source = "soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=s3_bucket_versioning_enabled"
}

Limits:

• Only sources whose host ends in .compliance.tf are checked.
• ?disable= takes a comma-separated list and may repeat; each control is reported once per module call.
• Every .tf, .tofu, .tf.json and .tofu.json file is read, root module or not.

Provider and module origin

Checks where providers and modules come from and how tightly they are pinned. These findings carry no control id; to waive one, write an exception with rule: instead of control: (see Exceptions).

A constraint is bounded when at least one of its comma-separated parts is an exact version or starts with =, ~>, < or <=. An empty constraint, or one made only of >, >= and != parts, is unbounded.

Tagging

Checks the effective tags on planned resources against the tags and required_tags settings. Runs at post_plan, and only when the settings file defines a tag policy.

Limits:

• Covers managed resources being created, updated or replaced. Resources with no tags or tags_all attribute are out of scope.
• Effective tags are the provider's constant default_tags, then tags, then tags_all.
• A rule with resource_types applies only to those types.
• At most one finding per resource per rule. Messages never contain a tag value.

Sensitive changes

Checks the plan for changes that weaken security or destroy data. Runs at post_plan over managed resources being created, updated, deleted or replaced. An attribute that is unknown at plan time never fires. When the catalog maps the attribute to a compliance.tf control for that resource type, the finding carries the control and is marked as one a compliance.tf module prevents.

ctf.risk.sensitive_change_public_exposure

ctf.risk.sensitive_change_wildcard_iam

Checks the policy of aws_iam_policy, aws_iam_role_policy, aws_iam_user_policy and aws_iam_group_policy, and aws_iam_role inline_policy, for an Allow statement with no Condition on Resource: "*":

ctf.risk.sensitive_change_audit_log_removal

ctf.risk.sensitive_change_encryption_disablement

Every case is an error:

• encrypted or storage_encrypted turned off or removed on aws_ebs_volume, aws_db_instance, aws_rds_cluster, aws_efs_file_system or aws_redshift_cluster.
• aws_dynamodb_table server_side_encryption enabled removed.
• aws_s3_bucket_server_side_encryption_configuration deleted, or its rule block removed.
• aws_eks_cluster encryption_config removed.
• kms_master_key_id emptied on aws_sqs_queue or aws_sns_topic.
• aws_kms_key enable_key_rotation turned off.

ctf.risk.sensitive_change_destructive_stateful

Stateful types: aws_db_instance, aws_rds_cluster, aws_dynamodb_table, aws_s3_bucket, aws_efs_file_system, aws_elasticache_cluster, aws_elasticache_replication_group, aws_redshift_cluster, aws_docdb_cluster, aws_neptune_cluster, aws_opensearch_domain, aws_ebs_volume, aws_fsx_lustre_file_system, aws_fsx_windows_file_system, aws_msk_cluster, aws_kms_key, aws_secretsmanager_secret.

Sensitive-change rules are tied to AWS provider resource types and attribute names. Resources from other providers are not checked.

Coverage (report)

Preview. ctfkit report runs these at post_init, over the compliancetf-manifest.json file that each compliance.tf served module carries in .terraform/modules. The receipt it writes is covered under report.

Terms used below:

• A served module is a module init downloaded from a compliance.tf host.
• Its manifest, compliancetf-manifest.json, records which controls the build enforces and what it does not prove.
• A degraded build is one where the manifest records that part of your organization's posture could not be applied, with the reasons.
• A delegated control is one the module leaves to another scope, such as a separate module, to enforce.
• An obligation is something the manifest says the module does not prove, together with what you must do instead.

Limits:

• A module instance whose own directory declares no resource block, such as a helper of data sources, locals and outputs, is listed but not reported by manifest_missing.
• For manifest_missing, the fix names a compliance.tf module when the instance's own resource types map to one in the catalog. A remote module that was never downloaded gets no fix.
• A manifest in a schema major version this ctfkit does not support is an environment error, exit 2, not a finding.
• No --tests-json input means no tests_failed finding.

What analyzers never do

• Evaluate HCL. At pre_plan only literal values resolve.
• Guess a value that is unknown until apply.
• Read live cloud state or call a provider. post_apply is reserved and has no analyzers.
• Run terraform or tofu, or open a network connection.

The analyzer SDK that these families are built on is in preview.